India, Oct. 21 -- A private key meant to vouch for the security of websites around the world turned out to be the number 4.

That was one of the weaknesses researchers found in eight intermediate certificate authority (CA) certificates issued by Bengaluru-based eMudhra.

The discovery prompted Google, Mozilla, Apple, and Microsoft to block the affected certificates, triggering a wider effort to protect browsers, applications, and enterprise systems. The incident also rattled investors and eMudhra shares hit their 20% lower circuit at Rs.431.55 on the BSE today.

The immediate concern is whether software still trusting the compromised keys could accept fraudulent certificates. A related challenge is replacing legitimate certificates affect...