Apple has blocked a set of website certificates issued by the certificate authority eMudhra, after Mozilla found their private keys could be recovered almost instantly.
A certificate is how a website proves it is the site it claims to be. Its private key is the secret that makes the proof work, and it only works if nobody can guess it. According to Mozilla's investigation, the keys in these certificates were all numbers below 256. That leaves a few hundred possibilities, a search a laptop finishes in an instant. Dennis Jackson, a Mozilla cryptography engineer, laid out the findings in an advisory.
With a recovered key, an attacker could create fraudulent certificates that vulnerable software would trust, letting them impersonate a legitimate website. Apple's block means software that relies on Apple's system checks will no longer trust the affected certificates.
The practical exposure looks narrow. Jackson said Safari and other major browsers run additional certificate checks that would have stopped attacks through this route. The risk sits with software that leans only on the operating system's verdict. Whether attackers exploited any of that software is unknown.
The episode is a reminder that the system rests on certificate authorities doing basic key hygiene, and that the fix often arrives from outside the authority. Browsers have pulled trust from certificate authorities over lapses before, DigiNotar in 2011 being the best-known case. This one was caught by a browser maker's review and patched by a device maker, which leaves open how a key this weak was issued in the first place.