Something’s off.A report says certification authority eMudhra published some certificate-signing private keys that were trivially guessable—one allegedly consisted only of the number “4.” Private keys are meant to be difficult to derive; if a signing key can be guessed, the report says certificates could be forged to impersonate websites or other resources.
According to the report, eMudhra says the keys were generated during an April 30, 2025 key-generation ceremony using FIPS 140-2 Level 3 hardware security modules. The company reportedly attributes the problem to a flaw in a wrap/unwrap step: strong keys were generated, but a second weak set was produced and published to browser root stores. It says it is still investigating the root cause and is providing replacement certificates to potentially affected customers.
The oddity is not merely that weak keys were reported, but that they were reportedly produced alongside strong ones by hardware intended for secure key handling, then made it into browser trust stores despite two years of independent audits.
UNVERIFIED
Feed metadata identifies a report, not independently verified underlying facts.
This is a source-attributed report whose underlying claims have not been independently verified.
