Risky Business · Wednesday, October 21, 2026
Mark Khoury and Patrick Gray reveal that an unnamed certificate authority (identified as eMudra) generated intermediate certificate private keys with extremely low entropy, as small as 8 bits. Mozilla has since revoked the affected certificates.
“The private key associated with these intermediate CAs, CA certs, was one of them was four, the number four.”
“this is some company called eMudra, I guess, is how you would pronounce that. And yeah, so I think Mozilla's already revoked those certs. I think six of them were for TLS, two of them were for code signing.”