India, Oct. 21 -- What has happened

When a browser shows a padlock, it has checked a digital certificate that says the site is the one it claims to be. Certificate authorities issue those certificates and vouch for them. A browser trusts a small set of such authorities, which in turn use signing keys called intermediate certificates to issue certificates for individual websites.

If an outsider obtains one of those intermediate signing keys, they can create a certificate for any website, and a computer that trusts that authority will accept it as genuine. The holder can then impersonate a website or a mail server, and read or alter the traffic that passes through them.

On 30 April 2025, eMudhra, an Indian certificate authority, created ...