When a browser shows a padlock, it has checked a digital certificate that says the site is the one it claims to be. Certificate authorities issue those certificates and vouch for them. A browser trusts a small set of such authorities, which in turn use signing keys called intermediate certificates to issue certificates for individual websites.
If an outsider obtains one of those intermediate signing keys, they can create a certificate for any website, and a computer that trusts that authority will accept it as genuine. The holder can then impersonate a website or a mail server, and read or alter the traffic that passes through them.
On 30 April 2025, eMudhra, an Indian certificate authority, created eight such intermediate certificates. Their private keys should have been random 384-bit numbers on the P-384 elliptic curve, a range of about 10^115 possibilities. Instead they were single-byte numbers: 4, 56, 66, 115, 155, 156, 230 and 237.
A single byte has 256 possible values, so recovering the key takes a few hundred calculations on a laptop. Security researcher Scott Helme recovered all eight from the companies' public certificates in under a second. Nothing in a certificate reveals a weak key, he wrote, because the encoding and the curve look valid. The only way to find out is to try.
A forged certificate is useful only to an attacker who sits between two parties and relays their encrypted traffic. That is far easier on a network the attacker controls, such as public Wi-Fi, a university or an office. Ars Technica reported that the most immediate exposure was for people using VPNs.
The failure concerns identity, not the encryption that scrambles data. Signal, WhatsApp and WireGuard do not depend on this certificate system for confidentiality and were not affected.
There is no evidence so far that anyone used the weak keys. The Chrome Root Program said no certificate from the six website-issuing intermediates had been logged in Certificate Transparency before it blocked them. Independent analysis found the eight had issued no logged certificates at all. eMudhra said one of the intermediates had been deployed in production but that none of them issued an end-entity certificate.
The problem is not closed, because revocation is not universal. Browsers fetch blocklists in the background, so Chrome and Firefox blocked the certificates within hours without an update, and Apple and Microsoft followed on 19 and 20 October. Many other programmes never check whether a certificate has been revoked. They stop trusting one only when the software itself is updated. That covers Linux and BSD distributions, container images, Internet-of-Things devices and command-line tools that ship their own certificates. Go released versions 1.27.3 and 1.26.10 on 19 October with the keys written into the software, tracked as CVE-2026-111943.
Update your browser and your operating system, and restart them so the update takes effect. Current Chrome, Firefox, Safari and Edge versions are protected. Ars Technica reported that Edge on Windows 10 was still connecting to 12 vulnerable hosts when it published its report.
On a work laptop or a server, update the package that holds the list of trusted certificates, and do not disable certificate verification to clear an error afterwards. That removes the protection the update restores.
Developers should update the trust stores their tools use rather than only the software that called them. Mozilla's engineer Dennis Jackson has published a list of patched software. It includes Ubuntu, Alpine, Arch and Gentoo certificate packages, NSS 3.131.1, curl's certificate bundle, Go 1.27.3 and 1.26.10, Python's certifi 2026.10.19 and Rust's webpki-roots 1.0.10. Cyber Security News reported that Debian's ca-certificates package, FreeBSD's ca_root_nss, and the Node.js and Composer bundles were still pending. Rebuild container images afterwards and check the dependency tree, because some of these arrive indirectly. A browser test does not prove that a background service on the same machine is protected.
Administrators can test a specific programme against the disclosure page set up by Mozilla's Dennis Jackson. A certificate error means that programme no longer trusts the compromised intermediates, though the result covers only the client tested.
eMudhra said its investigation is continuing and that it will publish further updates as findings are confirmed. It has attributed the weak keys to an error in a script used to generate the certificates in April 2025, according to BleepingComputer. It has not published a final account of how the keys were created, or of how the failure went unnoticed for 18 months.