The Day the Padlock Lied: Inside a Certificate Authority Crisis
How this was made Verified AI
Every Intellegix briefing is generated from that day's broadcast and run through automated checks before it publishes — with a human paged on any flag. Here is the trail for this edition.
The story generating more than 400 Hacker News comments begins with a number: eight. That is the bit-length of RSA keys discovered in an intermediate certificate chain operated by eMudhra, an Indian certificate authority holding trusted root status in major browser stores worldwide. Modern RSA certificates use 2,048 to 4,096-bit keys. Eight bits is not a rounding error or a misconfiguration — it is a key so trivially weak that UK security researcher Scott Helme was able to factor it, meaning crack it entirely, in milliseconds.
The practical stakes are severe. When a browser displays the padlock icon indicating a secure connection, it is vouching for a chain of certificates anchored at a root CA the browser has explicitly decided to trust. If an intermediate CA's keys are compromised, an attacker could in principle generate certificates for any domain that would appear fully valid — enabling man-in-the-middle attacks in which a browser would truthfully report a fraudulent certificate chain as legitimate. A dedicated disclosure site, emudhra.we-have-a-problem.com, documents the responsible disclosure timeline and eMudhra's response.
The Hacker News community is split between outrage directed at eMudhra and deeper structural questions about the web's public key infrastructure. The entire system depends on browsers maintaining a list of trusted organizations; negligence or compromise at any one of them cascades through the whole. A key question the thread has not yet cleanly answered: how an eight-bit key — almost certainly a test or dummy credential never intended for live use — entered a certificate chain that browsers accept as authoritative.