First screen, captured 4 days ago.

eMudhra to exit global SSL/TLS certificate business

What HN thinks

A certificate authority picked 4 as its private key, and the internet responded with roughly 400 analogies about car keys.

eMudhra can't be trusted anywhere
Blaming social media instead of apologising shows they don't understand trust, and their other security products deserve the same suspicion.
Corporate culture and crony regulation
Some tie the non-apology to Indian regulatory capture and mandated vendors, while others say never admitting fault is standard corporate PR everywhere.
Web PKI itself is broken
Any one CA can undermine everyone, so commenters propose scoped CAs, CAA/DANE, fewer nonprofit CAs, or Convergence-style client-side trust.

Consensus: Nearly everyone agrees the weak keys were inexcusable for a CA and that exiting TLS while keeping other trust services doesn't restore credibility. How the bug happened (truncated byte, test keys, slot numbers) remains speculation.

Recommended in the comments

Convergence ↗ (tool): Gives clients rather than servers a say in who they trust.
Let's Encrypt (service): Suggested as a model for a small set of competent nonprofit CAs.

Summarised by Claude from the comment thread 3 days ago.

Points: 1097
Comments: 703
Best rank: #1
Posted: 2026-10-22 by bo0tzz
Category: Security

emudhra certificate-authority ssl-tls pki web-pki browser-root-programs

All captures:

Full page

Captured 4 days ago. Click for the whole screenshot.

Looks similar

Screenshot of scotthelme.co.uk: Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds

Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds (scotthelme.co.uk)

875 points by hkc 5 days ago | 456 comments

Scott Helme blog post explaining how eight eMudhra intermediate CA private keys were single-byte P-384 values recoverable in milliseconds, and who remains exposed.

emudhra certificate-authorities pki tls