eMudhra ignored Mozilla Root investigation deadline; blames social media
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Eight eMudhra intermediate CAs were revoked for caCompromise after outsiders found their P-384 private keys were tiny integers (below 256), recoverable almost instantly. Six issued TLS certificates chaining to roots trusted by major browsers. eMudhra attributes the flaw to a key-ceremony script error, and Sectigo revoked the cross-signs. Bun 1.4.4 now removes the root and blocks the eight keys, since it checks revocation only via a user-supplied CRL. eMudhra announced its exit from global TLS. Teams with bundled trust stores should check them; several figures here come from unsourced claims.
Score
0.76total under rubric v2.0Contestedjudges differ by 0.45 on overclaim
- Significance0.83
- Reader interest0.87
- Audience breadth0.73
- Practical relevance0.78
- Substantiated0.91
- Technical depth0.91
- New information0.93
- Counts against: Promotional0.07
- Counts against: Overclaim0.49
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.78 | 0.80 | 0.90 | 0.83 | 0.12 | +0.25 | +0.206 |
| Reader interest | 0.80 | 0.85 | 0.96 | 0.87 | 0.16 | +0.20 | +0.174 |
| Audience breadth | 0.78 | 0.70 | 0.72 | 0.73 | 0.08 | +0.10 | +0.073 |
| Practical relevance | 0.76 | 0.70 | 0.88 | 0.78 | 0.18 | +0.15 | +0.117 |
| Substantiated | 0.94 | 0.85 | 0.94 | 0.91 | 0.09 | +0.10 | +0.091 |
| Technical depth | 0.99 | 0.80 | 0.93 | 0.91 | 0.19 | +0.10 | +0.091 |
| New information | 0.90 | 0.90 | 0.98 | 0.93 | 0.08 | +0.10 | +0.093 |
| Promotional | 0.17 | 0.02 | 0.01 | 0.07 | 0.16 | −0.15 | −0.010 |
| Overclaim | 0.65 | 0.20 | 0.62 | 0.49 | 0.45 , above the contested threshold | −0.15 | −0.073 |
| Sum of contributions | +0.761 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.761 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
Claim check
Claim check: 1 matches source · 6 no source given · 1 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenDate
The private keys of 8 eMudhra intermediate certificates were reported compromised to Mozilla on 17 October, and Mozilla confirmed the proof of key control was valid.
The article gives no link or citation for it.
The article says “On 17th October @ 20:06 UTC, Mozilla received a report to certificates@mozilla.org, forwarded by the Chrome Root program, from Wayne, that the private key of 8 eMudhra Intermediate certificates have…”
The source says No source to compare with.
No source givenNumber
The 8 impacted P384 keys all used private key integers less than 256, so they can be recovered near instantly.
The article gives no link or citation for it.
The article says “The 8 impacted keys all used integers less than 256. That is, the private keys are effectively all-zeroes apart from the last byte”
The source says No source to compare with.
Couldn’t checkDate
Mozilla completed distrust of the impacted certificates in Firefox via OneCRL at 22:59 UTC on 17 October.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “This process was tracked in Bug 2083382 and completed @ 22:59 UTC”
The source says No passage could be compared.
Source cited by the article: bugzilla.mozilla.org/show_bug.cgi
No source givenCausal conclusion
eMudhra said the weak keys resulted from a flaw in the key generation ceremony script during an approved wrap/unwrap test deviation, and the weaker second key pair was used by mistake because key labels were similar.
The article gives no link or citation for it.
The article says “a flaw in the code resulted in the second pair of keys being created onboard which were weaker”
The source says No source to compare with.
No source givenCausal conclusion
Mozilla decided on emergency removal of trust in emSign ECC Root CA - G3 after multiple individuals independently recovered the private keys.
The article gives no link or citation for it.
The article says “we have decided that the circumstances warrant the emergency removal of trust in emSign ECC Root CA - G3”
The source says No source to compare with.
No source givenNumber
eMudhra estimated about 30,000 certificates need migration, about 97% issued via ACME.
The article gives no link or citation for it.
The article says “there are about 30,000 certs that require migration and about 97% came via ACME”
The source says No source to compare with.
No source givenDate
Mozilla sent questions to eMudhra on 20 October asking for a response within 24 hours; after an extension request, no response had been received by Friday 23rd.
The article gives no link or citation for it.
The article says “As of the time of writing on Friday 23rd, Mozilla has not received a response to these questions”
The source says No source to compare with.
Matches sourceQuote
eMudhra said it recently voluntarily decided to withdraw from the global SSL/TLS certificate business.
The cited source says the same thing.
The article says “decided to voluntarily withdraw from the global SSL/TLS certificate business”
The source says “its Board has decided to voluntarily withdraw from the global SSL/TLS certificate business”
Source cited by the article: emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business
Also covered by
Elsewhere
Elsewhere: HN 201 pts, front page
Recorded for context only, checked 24 Oct 2026, 08:53 UTC. It played no part in the ranking.