The Private Key Was the Number 4
Eight secret keys guarding the web were small enough to guess by hand — one was 4. Five days later, eMudhra has lost a third of its market value and its global TLS business. The company calls it 1% of revenue. The market is pricing something much bigger.
On Saturday evening, October 17, at 20:06 UTC, Mozilla's security team received an email. Attached was a short message — "We have a problem here – Wayne" — digitally signed with the private key of an intermediate certificate belonging to eMudhra Limited, one of the certificate authorities the entire web silently relies on.
That signature should have been impossible to produce. The fact that it existed meant someone outside eMudhra held the keys to one of the internet's locks — and within two hours, Mozilla's engineers had independently recovered the keys themselves, confirming the worst version of the story: anyone could.
A 384-bit lock with a one-digit combination
Certificate authorities are the notaries of the web. When your browser shows a padlock next to your bank's address, it's because a CA cryptographically vouched that the site is who it claims to be. The whole system rests on one assumption: the CA's private keys are secret, enormous random numbers that no one can guess.
A properly generated P-384 private key is drawn from a pool of roughly 2^384 possibilities — a number 116 digits long. According to Mozilla's incident report, the private keys behind eight eMudhra intermediate certificates were the integers 4, 56, 66, 115, 155, 156, 230, and 237. All eight fit in a single byte. A security researcher going by Wayne found them on October 17 by scanning public certificate data; Mozilla reproduced the break the same evening with no hints. One Mozilla engineer reported that AI agents handed the task recovered a key on the first attempt with a one-line prompt.
With any of those keys, an attacker positioned on a network — a hostile Wi-Fi hotspot, a compromised ISP, a government intercept — could have minted a trusted certificate for any website on earth and read the "encrypted" traffic. Certificate transparency logs show no evidence that this happened via logged certificates, but as the incident trackers note, much of the software world outside browsers doesn't check those logs. The keys had been recoverable since they were created in April 2025.
The response was the fastest coordinated distrust in recent memory. Mozilla blocked all eight certificates within three hours of the report — no browser update required. Chrome blocked them the same day; Apple followed on October 19, Microsoft on October 20. Then Mozilla went further and announced the emergency removal of eMudhra's entire ECC root from its trust store, with Chrome expected to ship the same removal in its root store update around October 27. Roughly 30,800 unexpired certificates chain to that root — 99.9% of them issued through InCommon, the trust federation used by US universities and research institutions, which now have days to migrate.
Filippo Valsorda, the cryptography engineer who maintains Go's crypto libraries, told Ars Technica the cleanup will be "bigger than Heartbleed" — a long tail of IoT devices, Docker containers, and forgotten Linux machines that will keep trusting the broken certificates until someone updates them.
Briefings like this are free to read with a free AlphaBriefing membership. Join free →
The company on the other end of the key
eMudhra Limited (NSE: EMUDHRA) is a Bengaluru-based digital trust company — a government-licensed certifying authority for India's digital signature regime, with a global TLS certificate arm under the emSign brand and an enterprise software suite sold in more than 35 countries. It listed in 2022 and earned ₹702 crore (about $74 million) in revenue in the fiscal year ended March 2026, growing 35% with a net profit of ₹110 crore.
The market's verdict was immediate and brutal. The stock fell 20% on Wednesday — the exchange's daily limit — and another 20% on Thursday, closing at ₹345.60, a 52-week low, down 36% in two sessions and roughly half its 52-week high of ₹682. Trading volume on Thursday ran at more than 15 times the recent daily average.
The company's response escalated almost as fast as the browsers'. On October 21, eMudhra stated that its infrastructure was not hacked — the weak keys came from a flawed script in an April 2025 key generation ceremony — that its India signature businesses are unaffected, and that the global TLS business represents "around 1% of the company's revenue." A day later, Reuters and Indian financial media reported the company is exiting the global TLS certificate business entirely. India's IT ministry has set up a team to investigate, and CERT-In, the national cyber agency, has issued an advisory.
Here is the tension every investor should sit with: eMudhra says the dead business was 1% of revenue — roughly ₹7 crore a year. The market just erased about ₹1,600 crore (roughly $170 million) of equity value in two sessions. That is more than 200 years of the exited business's revenue. Either the market is wildly overreacting to a rounding error, or this was never about the 1%.
A free membership gets you access to every free article at AlphaBriefing.com: Join AlphaBriefing
The rest of this briefing is for paid members: what the 36% drawdown is actually pricing (four distinct risks, only one of them cosmetic), the three historical precedents for a distrusted CA and what happened to each company's shareholders, the November 4 earnings checklist, and the one tail risk in India that would change the thesis entirely.
AlphaBriefing Paid gets you every investment thesis, scenario framework, and catalyst brief we publish — the analysis private intel clients pay four figures for, at a fraction of that.