Eight Flawed Certificates Expose Billions of Devices to Risk
A security lapse involving eight intermediate CA certificates has left older devices and software vulnerable to impersonation attacks.
By Chioma Brooks ·
The private keys behind eight intermediate certificates were only one byte in length, reducing the entire secret to a number between 0 and 255 that can be guessed instantly. This lapse, issued by the Indian certificate authority eMudhra, has created a critical security vulnerability affecting billions of older devices and software installations worldwide. Administrators are now scrambling to patch systems to prevent attackers from impersonating legitimate domains or disguising malware as trusted software.
The compromise allows an attacker positioned anywhere along a network path to intercept traffic and impersonate major sites such as apple.com, amazon.com, or bankofamerica.com. If systems are not updated, operating systems and installed software will not recognize the deception. Additionally, the use of code-signing certificates enables malicious applications to falsely appear as legitimate software from major vendors like Microsoft or Google.
The certificates were issued to bypass the standard security protocol, which relies on a chain of trust. A website's certificate is normally signed by an intermediate Certification Authority, which is in turn signed by a trusted root certificate whose keys are kept offline in safes. In this instance, eMudhra issued six TLS and two code-signing intermediate certificates with easily guessable keys, breaking this chain.
To address the issue, operating systems and software maintain lists of trusted root certificates and CAs, while browsers maintain a revocation list of those not to be trusted. These lists are periodically updated to reflect security issues. To remedy the current situation, all eight CAs must be revoked, the affected root certificate removed, or a hard-coded rejection of all eight affected keys implemented.
Recent versions of major browsers, including Chrome, Brave, Firefox, and Safari, enforce a feature called Certificate Transparency. This feature consults a public read-only log of certificate issuances and blocks any that are not listed. Google reports that no certificates signed by the six affected intermediate CAs were logged, meaning that regular web browsing should be safe. However, users are still advised to check all software for updates.
The scope of the required updates is vast, covering PCs, servers, operating systems, phones, tablets, routers, web browsers, virtual servers, virtual machines, Docker containers, and programming languages like Python, Go, Node.js, and Rust. Standalone download utilities like curl are also affected. While recent devices are expected to receive updates, older routers, smart and IoT appliances, and old computers could eventually present a problem.
The root cause of why the private keys were only one byte long is still under investigation. As of October 22, 2026, the technical details regarding how this error occurred remain unclear.
