India, Oct. 21 -- A Bengaluru company that the world's major browsers trust to vouch for websites created the secret keys for eight of its certificates with a flaw so basic that anyone could have worked them out in seconds. Google, Mozilla, Apple and Microsoft have had to take emergency action to stop their software from trusting the certificates.

The company, eMudhra Ltd, should have generated each key as a number about 116 digits long, chosen at random. The keys it actually used were 4, 56, 66, 115, 155, 156, 230 and 237, numbers a computer can find in a fraction of a second by trying every value up to 255.

All eight were intermediate certificates, the kind a certificate authority uses to issue certificates to websites and software ma...