On 2026‑10‑22 I learned that the Indian certificate authority eMudhra had private keys of eight of its HTTPS certificates compromised, a breach confirmed by Mozilla.
- 8 certificates had their private keys compromised.
Mozilla’s rapid revocation (within three hours) reflects the severity of a 4‑digit private key that anyone could guess to forge HTTPS certificates for any website.
- Firefox blocked the affected certificates within 3 hours of discovery.
- Expected private‑key length: 116‑digit number.
- One compromised key was only 4 digits long, making it trivially guessable.