Browsers Block eMudhra Certificates After Key Flaw

Bengaluru-based digital trust company eMudhra generated eight intermediate certificate authority (CA) private keys with minimal randomness, which attackers could recover almost instantly. Six of the affected certificates were authorised to issue TLS certificates for websites, potentially allowing attackers to impersonate domains they did not control on systems that still trusted the compromised keys. The other two were intended for code signing.