Eight Compromised TLS Certificates Trigger Internet Alert

WHO:

Techmeme - The compromised certificates were issued by eMudhra.

Techmeme - Browser makers and major apps blocked the certificates.

Ars Technica - Intermediate TLS certificates can allow anyone to mint web credentials for any internet server.

WHAT:

Techmeme - Eight intermediate TLS certificates were compromised.

Techmeme - The certificates had private keys only 3 to 8 bits in size.

Techmeme - Browser makers and major apps blocked the compromised certificates.

Ars Technica - The discovery of eight compromised TLS certificates prompted an internet security alert.

WHY:

Cointelegraph - A flaw in private-key generation made the keys guessable and enabled the forging of HTTPS certificates for any website.

Ars Technica - Intermediate certificates can be used to mint web credentials for any internet server.

HOW:

Techmeme - The certificates’ private keys were described as only 3 to 8 bits in size.

(UPDATED October 21, 2026 06:00 UTC)

A flaw in private-key generation made the keys guessable, enabling attackers to forge HTTPS certificates for any website.

--

(UPDATED October 21, 2026 00:40 UTC)

An internet security alert followed the discovery that eight intermediate TLS certificates issued by eMudhra had been compromised. These certificates can be used to create web credentials for any internet server, and their private keys were only 3 to 8 bits in size. Browser makers and major apps have blocked the compromised certificates.