Eight security certificates with private keys so weak a human could guess them have been pulled from use, and Apple took until October 19 to protect iPhones and iPads against them, two days behind Google and Mozilla.
The certificates came from Indian certificate authority eMudhra, which revoked them after security researchers disclosed the problem on October 17. Six of the eight were TLS certificates, the kind that encrypt web traffic and verify a site actually is who it claims to be. They were trusted by root programs run by Apple, Google, Microsoft and Mozilla. The other two were code-signing certificates trusted by Microsoft.
What made these certificates remarkable wasn't that they were cracked. It's that there was nothing to crack. A proper private key runs well over 100 characters and would take far longer than anyone's lifetime to brute-force. The keys behind these eight certificates were just short numbers: 4, 56, 66, 115, 155, 156, 230 and 237. According to a bug report Mozilla filed, its engineers recovered the private keys easily, without any help from whoever originally found the flaw.
Chrome and Firefox moved first. Google blocked six compromised intermediates on October 17, the same day Mozilla pushed out a block through Firefox's OneCRL revocation system, which didn't require users to update the browser or even restart it. Apple added its protections in iOS and iPadOS two days later, on October 19.
Mac users aren't fully covered yet
The fix is messier on macOS. Apple's built-in curl utility doesn't check certificate revocation status, so a Mac that already trusted one of the eight certificates will keep trusting it going forward unless something else intervenes. AppleInsider reports that the practical risk still looks low: most of the certificates never made it into production use, and nobody has found evidence that an attacker got to the keys before researchers did.
That's a bit of luck. The certificates were generated back in April 2025, which means the guessable keys sat out there, unnoticed, for well over a year.
EMudhra said in a statement that there was no breach of its infrastructure and no sign any customer data was exposed. The company says it's working with affected customers to replace the compromised certificates now.
For regular users, the advice is unglamorous but simple: install the latest iOS, iPadOS and macOS updates, and keep apps current. Apple hasn't said whether a dedicated macOS patch addressing the curl revocation gap is coming, and eMudhra hasn't given a timeline for finishing the certificate replacements across its customer base.
MDFiled by The Mobile Desk
Phones from leak to launch to price cut: what was announced, what it costs where, and when it goes on sale. Indian launches and prices included, not appended.
More from this desk →
Be the first to comment
Join the argument. No password, just your email or a passkey.