Indian certification authority eMudhra’s private keys compromised – one of them was the number ‘4’

eMudhra, an Indian CA that has issued over 60 million digital certificates, suffered a critical security breach when eight intermediate certificate private keys were compromised. Notably, some keys were absurdly weak (including the number '4'). Attackers could use these compromised keys to forge HTTPS certificates for any domain, enabling server impersonation and traffic interception. Mozilla, Chrome, and Apple have revoked trust in these certificates, and FOSS projects have issued updates to reject eMudhra-signed certificates, but certificates already signed with the compromised keys remain in circulation.

Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Register did the reporting; read the original for the full story.