India, Oct. 21 -- Your browser checks digital certificates every time you visit a secure website, usually without you noticing. But those checks depend on certificate authorities keeping their signing keys secure. A mistake at Indian digital trust provider eMudhra has shown what can happen when that protection fails.

Eight of the company's intermediate certificate-authority keys turned out to be so weak that anyone could recover their private values by testing fewer than 256 possibilities. Mozilla, Google and Apple have moved to block the affected certificates, but the problem may not be over for applications that don't receive the same security updates.

The weakness affected credentials created in April 2025, including six intermediate...