India, Oct. 31 -- On October 27, Google removed eMudhra's root certificate called emSign ECC Root CA - G3. Any website still relying on it began showing Chrome users a full-page security warning.

This action follows a series of events that unfolded in mid-October with Bengaluru-based eMudhra, India's largest licensed certifying authority, at the centre of it all.

A researcher had shown that the private keys of eight certificate authorities under eMudhra's global hierarchy were so weak that anyone could work them out. One of them was the number 4.

What followed was swift action, at least outside India. All major browser makers blocked the certificates within hours. Software maintainers shipped emergency patches and eMudhra revoked the c...