AIAR

When you see the little lock next to a website address, it means a company called a certificate authority has promised that site is real. This month, one of those companies, eMudhra in India, was caught using secret keys so weak that one of them was simply the number 4, The Register reported. Web browsers around the world rushed to block them.

Here is why that matters. A certificate is like a digital ID card for a website, and a private key is the secret pen used to sign those cards. Anyone who has the pen can make fake ID cards for any site, such as a fake bank page that still shows the lock. A good key is a random number more than 100 digits long. eMudhra’s eight exposed keys were tiny numbers like 4, 56 and 115, which a computer can guess in an instant, according to security researcher Scott Helme’s analysis cited by The Register.

A researcher spotted the problem on October 17 while scanning public certificate records. eMudhra blamed a script error from April 2025 that made a second, weak set of keys, which were picked by mistake because their labels looked like the real ones, BleepingComputer reported. That means the keys may have been guessable for about a year and a half. The company says it has no sign they were misused and that most were never used on live websites.

The response was fast. Firefox and Chrome blocked the keys within hours, and Apple and Microsoft followed within days, the Free Press Journal reported. Google is also removing eMudhra’s main certificate from Chrome. eMudhra’s stock fell sharply, though the company says the affected business is only about 1% of its revenue, according to Kotak Neo.

So which is the real story? One side says this proves the system works, because browsers caught it and shut it down in hours. The other side says a key of “4” sat there for 18 months, so the checks clearly failed. The whole web runs on trusting a small group of companies. Should one big mistake be enough to kick a company out for good?

The easy fix for you: update your browser and phone, because updates are how these blocks reach your device.

Sources:
The Register: Indian certification authority eMudhra’s private keys compromised
BleepingComputer: Mozilla, Google, Apple block compromised eMudhra CA certificates
Free Press Journal: Why Did Apple, Google, Microsoft, & Mozilla Block Certificates From Indian Firm eMudhra?
Kotak Neo: eMudhra Share Price Crashes 20% To Lower Circuit
This Week in Security: October 25, 2026 edition