India, Oct. 21 -- A Bengaluru company that the world's major browsers trust to vouch for websites generated the secret keys for eight of its security certificates so poorly that anyone could have worked them out in seconds. Google, Mozilla, Apple and Microsoft have blocked the certificates, the Union government has set up a special team to investigate, and security experts are warning that the clean-up will be long and difficult.

The keys belonged to eMudhra Ltd, a listed certifying authority. Each should have been a randomly chosen number about 116 digits long, but one of them was simply the number 4. With the keys, anyone could have issued certificates, the digital identity cards websites use to prove who they are, for any website in t...