Scott Helme’s reproduction opens with a sentence that needs no gloss: “One of eMudhra’s certificate authority private keys is the number 4.” A P-384 key should be a random 384-bit number; these were 47 bytes of zeros and one byte, so recovering one from its public certificate took “less than a second” and brute force is at most 255 steps. Eight intermediates were affected, six TLS issuing and two code-signing, all created in April 2025 and cross-signed by Sectigo’s AAA Certificate Services root that May. The keys were not stolen. Anyone who saw the certificate could derive them. The reporter, Wayne, signed a message with each of the eight and took it to the root program teams on 17 October.

Browsers are the easy case

Chrome and Firefox blocked the intermediates the same day through CRLSet and OneCRL, Apple devices on the 19th, Microsoft platforms on the 20th. Mozilla shipped NSS 3.131.1 plus Firefox 158.0.1 and two ESR updates for users with custom settings. The long tail is the problem. Helme’s summary: non-browser TLS clients “trust a CA bundle on disk, they don’t check revocation by default, and they don’t check CT”. He showed a forged certificate for api.stripe.com being accepted by curl, which printed “SSL certificate verify ok”, and by Python and Node on stock systems. That is the shape of install scripts, CI runners, SDKs and container base images.

What to do

Update the CA bundle, not the browser. Ubuntu’s fix removes the two roots that cross-signed the eMudhra CA, emSign Root TLS CA G3 and Comodo AAA Certificate Services: sudo apt update && sudo apt upgrade covers it, and 20.04 or older gets the fix through Ubuntu Pro ESM. Arch says the compromised certificates are “removed/invalidated with ca-certificates-mozilla >= 3.131.1-1”, and that “without an update to this central certificate bundle, systems are susceptible to man-in-the-middle attacks”. The disclosure site’s own table lists patched ca-certificates builds for Ubuntu, Debian, Fedora, Alpine Linux, Gentoo and Arch Linux; Ubuntu and Arch are the two quoted here as worked examples. The same applies to Python’s certifi, Node, Homebrew and any image that bundles a trust store, with a rebuild once the base image has the change. Ubuntu notes the side effect: a legitimate certificate chaining to either removed root can stop being trusted, so “this may result in some hosts being unreachable”.

Test it, and the tail that cannot be fixed

mitmproxy added a --emudhra option “to sign TLS certificates with a compromised eMudhra intermediate CA key” and dropped the CAs from its bundled certifi, which is a deliberate way to check whether a client still accepts a forged chain. Devices that cannot be updated at all “will trust these certificates until expiry, which is July 2039”.

The CVE is Go’s, not eMudhra’s

CVE-2026-111943, published on 21 October, is Go’s record for a denylist added to crypto/x509 “to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy”. It defends Go programs against a stale system store. It is not a CVE assigned to eMudhra, and nothing in this incident has one.

eMudhra’s account, and the exit

eMudhra’s explanation, as reported by The Register rather than independently confirmed, is that the keys came from “a Key Generation Ceremony (KGC) held on April 30, 2025, using FIPS 140-2 Level 3 Hardware Security Modules”, and that “a flaw in the KGC caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys. The weak keys were the ones published to the browser root stores.”

Today the board “has decided to voluntarily withdraw from the global SSL/TLS certificate business”: replacements “free of cost from partners”, revocation and status services running “until every issued certificate has expired or been replaced”, and a full root-cause report to the root programs. Its chairman says the CAs were revoked “within 14 hours of discovery” and that “there were no end entity certificates issued out of the affected CA’s”; the company puts the line at “about 1% of the global revenue” and calls the scrutiny “out of proportion to SSL/TLS’s place in our business”, which is its framing rather than an independent assessment.

For readers, eMudhra’s TLS line is now end-of-life: replace any certificate you hold through a partner or another CA, and update the trust store for the compromise itself.

Sources: the eMudhra disclosure site, Scott Helme’s analysis, Mozilla’s incident post, the Ubuntu security blog, Arch Linux’s news item, NVD’s CVE-2026-111943 record, the mitmproxy commit, The Register’s report, and eMudhra’s exit announcement.