--- title: 4 real? Tracking exploitation and patching of eMudhra’s... description: Cloudflare tracked exploitation and patching progress after eMudhra's certificate authority was found using eight weak keys, including the number 4. Anyone... canonical: https://daily.dev/posts/4-real-tracking-exploitation-and-patching-of-emudhra-s-weak-keys-cj3igvvtr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 4 real? Tracking exploitation and patching of eMudhra’s weak keys | daily.dev og:description: Cloudflare tracked exploitation and patching progress after eMudhra's certificate authority was found using eight weak keys, including the number 4. Anyone... og:url: https://daily.dev/posts/4-real-tracking-exploitation-and-patching-of-emudhra-s-weak-keys-cj3igvvtr og:image: https://api.daily.dev/og/posts/CJ3igvVtR.png og:image:alt: 4 real? Tracking exploitation and patching of eMudhra’s weak keys og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 4 real? Tracking exploitation and patching of eMudhra’s weak keys **[Cloudflare](https://daily.dev/sources/cloudflare)** · 8 min read · 0 upvotes · 0 comments ## Summary Cloudflare tracked exploitation and patching progress after eMudhra's certificate authority was found using eight weak keys, including the number 4. Anyone could recover these intermediate private keys directly from public certificates. Cloudflare patched its high-priority systems within hours and logged about 22,000 handshake attempts using the weak keys, including about 160 handshakes whose certificates named other organizations' domains, with one forged certificate dated less than an hour after the bug became public. Probing 50 million challenge page probes showed bots, which are unconfirmed, and old browsers still trust the weak keys, with 30-40% of Android WebView clients still accepting and over half of probes on large networks still accepting the compromised chain. eMudhra has since announced it is exiting the public CA business. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What were the actual weak key values used by eMudhra's certificate authority? eMudhra's eight compromised intermediate keys were the numbers 4, 56, 66, 115, 155, 156, 230, and 237, instead of a properly random 115-digit number. Because these values are trivially small, anyone could recover the private keys directly from the publicly available certificates and forge valid certificates for any domain. _Teams auditing PKI and certificate trust chains can follow incidents like this one as they unfold on daily.dev._ ### How quickly did attackers start exploiting the eMudhra weak key leak after it became public? Forged certificates appeared within about an hour of disclosure: one certificate was dated October 20 at 18:19 UTC, less than an hour after the Mozilla bug report went public. Over the following week, Cloudflare logged roughly 22,000 handshake attempts presenting certificates signed with the weak keys, including about 160 certificates with mismatched SANs. _Security teams tracking real-world exploitation timelines for CA incidents can follow coverage like this on daily.dev._ ### How many clients still trust a compromised certificate authority a week after a public disclosure like the eMudhra incident? A week after disclosure, probes across 50 million challenge page visits found that over half of traffic on large networks still accepted the compromised eMudhra certificate chain, and Android WebView clients still accepted it 30 to 40% of the time. Modern up-to-date browsers were mostly patched, but bots and older browsers lagged significantly. _Developers gauging how fast the ecosystem actually patches CA trust issues can follow real data like this on daily.dev._ ## Similar posts on daily.dev - [Check if eMudhra CA Is Still Trusted in Your Trust Stores](https://daily.dev/posts/check-if-emudhra-ca-is-still-trusted-in-your-trust-stores-acz7ry8nb) · SitePoint · 0 upvotes · 0 comments --- Tags: [#cryptography](https://daily.dev/tags/cryptography), [#cloudflare](https://daily.dev/tags/cloudflare) [View this post on daily.dev](https://daily.dev/posts/4-real-tracking-exploitation-and-patching-of-emudhra-s-weak-keys-cj3igvvtr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"4 real? Tracking exploitation and patching of eMudhra’s weak keys","url":"https://daily.dev/posts/4-real-tracking-exploitation-and-patching-of-emudhra-s-weak-keys-cj3igvvtr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/4-real-tracking-exploitation-and-patching-of-emudhra-s-weak-keys-cj3igvvtr"},"datePublished":"2026-10-30T17:40:05.251Z","dateModified":"2026-10-30T17:42:48.675Z","description":"Cloudflare tracked exploitation and patching progress after eMudhra's certificate authority was found using eight weak keys, including the number 4. Anyone...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6d15bcaaf23e40a86c7265bac52b2064?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6d15bcaaf23e40a86c7265bac52b2064?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Cloudflare","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Cloudflare","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/38522e1d11354cd6b7af66f9d4316735","url":"https://daily.dev/sources/cloudflare"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/4-real-tracking-exploitation-and-patching-of-emudhra-s-weak-keys-cj3igvvtr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cryptography,cloudflare","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cloudflare","item":"https://daily.dev/sources/cloudflare"},{"@type":"ListItem","position":3,"name":"4 real? Tracking exploitation and patching of eMudhra’s weak keys"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/4-real-tracking-exploitation-and-patching-of-emudhra-s-weak-keys-cj3igvvtr#faq","mainEntity":[{"@type":"Question","name":"What were the actual weak key values used by eMudhra's certificate authority?","acceptedAnswer":{"@type":"Answer","text":"eMudhra's eight compromised intermediate keys were the numbers 4, 56, 66, 115, 155, 156, 230, and 237, instead of a properly random 115-digit number. Because these values are trivially small, anyone could recover the private keys directly from the publicly available certificates and forge valid certificates for any domain. Teams auditing PKI and certificate trust chains can follow incidents like this one as they unfold on daily.dev."}},{"@type":"Question","name":"How quickly did attackers start exploiting the eMudhra weak key leak after it became public?","acceptedAnswer":{"@type":"Answer","text":"Forged certificates appeared within about an hour of disclosure: one certificate was dated October 20 at 18:19 UTC, less than an hour after the Mozilla bug report went public. Over the following week, Cloudflare logged roughly 22,000 handshake attempts presenting certificates signed with the weak keys, including about 160 certificates with mismatched SANs. Security teams tracking real-world exploitation timelines for CA incidents can follow coverage like this on daily.dev."}},{"@type":"Question","name":"How many clients still trust a compromised certificate authority a week after a public disclosure like the eMudhra incident?","acceptedAnswer":{"@type":"Answer","text":"A week after disclosure, probes across 50 million challenge page visits found that over half of traffic on large networks still accepted the compromised eMudhra certificate chain, and Android WebView clients still accepted it 30 to 40% of the time. Modern up-to-date browsers were mostly patched, but bots and older browsers lagged significantly. Developers gauging how fast the ecosystem actually patches CA trust issues can follow real data like this on daily.dev."}}]} ```