eMudhra: eight intermediate CA keys trivially recoverable (values below 256); browsers, Go, Apple, Microsoft block them; non-browser clients remain exposed
Eight intermediate CA certificates of the Indian certificate authority eMudhra (emSign brand), generated on 30 April 2025, were found to have P-384 private keys so weak (integers below 256) that anyone can recover them from the public certificates and forge browser-trusted certificates for any domain. A researcher credited as Wayne report…