One of eMudhra's certificate authority private keys was the number 4. Browsers blocked it in under two hours
2026-10-27Security
Eight intermediate CA keys were whole numbers below 256, recoverable from the public certificate in under a second. Browsers are fixed. Curl, Python and Node.js accepted a forged certificate anyway.