You Can't Rotate What You Haven't Inventoried

If a certificate authority you rely on were distrusted tomorrow, replacing its certificates would be the easy part and finding everything that trusts them would be the hard part.

A key that was the number 4

One of eMudhra's private keys was the number 4. Not a number that starts with 4. The number 4. A researcher recovered all eight compromised intermediate keys from their public certificates, because every one was smaller than 256, which means anyone could find it by testing at most 256 values, as SecurityWeek reported. Chrome and Firefox blocked the intermediates on October 17, Apple followed on October 19, and Microsoft on October 20.

The browsers moved fast, and that is the easy part, because browser vendors control their own trust stores. What I keep thinking about is everything else: the application that bundles its own root certificates, the appliance nobody has patched since the last audit, the internal service that pins a certificate because someone did it in 2019. None of those get a push update from Mozilla or Microsoft. (Ask any engineer who has chased a pinned certificate at 2 a.m. how that goes.)

One capability, two deadlines

The same gap sits underneath a slower story. A June 2026 executive order reportedly pulls post-quantum deadlines forward for federal systems (check the order's text before you quote any dates to a client, I would). I expect vendor roadmaps and contract terms to follow those benchmarks even for firms that never touch federal work. Moving to new cryptography means finding where the old cryptography lives, so the emergency and the multi-year migration need the same thing: an inventory of certificates, keys, libraries, and protocols, including the ones inside vendor-managed services. It is the same problem I wrote about with agents you don't know you have.

Three moves before the next one

Build the inventory first. Then test it with a fire drill: pick a certificate authority and ask how long it would take to find everything that trusts it and replace it. The eMudhra response is that drill, run live. Last, ask your vendors for what is being called a cryptographic bill of materials, the sequel to the SBOM. The story is still developing, so check current advisories before you act on specifics.