An Indian certificate authority has revoked eight intermediate digital certificates after a critical cryptographic flaw exposed private keys that were only one byte long, making them trivial for attackers to recover.

Bengaluru-based eMudhra said a script deployed in April 2025 generated the weak certificates. They were mistakenly used for certificate signing that month because their key labels were similar.

The affected keys had values ranging from zero to 255, leaving just 256 possible combinations. Cloudflare warned that attackers could potentially exploit the certificates to impersonate servers, intercept communications or modify network traffic.

The eight certificates included six for Transport Layer Security (TLS), trusted by major browser root programs, and two code-signing certificates trusted by Microsoft. eMudhra said only one affected certificate reached production and none were used to issue certificates for end-user systems.

Google Chrome and Mozilla Firefox blocked the certificates on Saturday, followed by Apple and Microsoft on Monday and Tuesday, respectively. Google also initiated action against the root certificate associated with the affected intermediates.

The incident has prompted security updates across several software ecosystems. Go, Python and Rust developers have issued or recommended updates, while Red Hat and Ubuntu have also advised users to apply available patches. A Java fix was still pending, according to the incident tracker.

A major concern is that many applications and certificate-validation libraries do not automatically process revocation information. Unlike modern browsers, these systems may require software updates before they stop trusting the compromised certificates, potentially leaving legacy devices and unpatched applications exposed.

eMudhra estimates that approximately 30,000 certificates must be migrated to an alternative trust chain. The incident has renewed concerns about certificate authority security audits and highlights the need for stronger key-generation controls, rapid certificate replacement and timely software updates.