India, Oct. 21 -- Eight intermediate certificates from eMudhra, an Indian certificate authority listed on the National Stock Exchange and the Bombay Stock Exchange, carried private keys so weak that anyone could recover them in under a second. The discovery has set off a clean-up across browsers, operating systems, cloud services and software packages.

eMudhra certificates are digital and electronic identity credentials issued by eMudhra, a licensed Certifying Authority (CA) in India.

The eight certificates were created on 30 April 2025 at a key generation ceremony. Six were TLS issuing certificates, split between eMudhra BV in the Netherlands and eMudhra Inc in the United States, and two issued code-signing certificates. All eight were...