It was discovered that one of India’s Trusted Certificate Authorities, eMudhra, tasked with signing website certificates to verify authenticity of HTTP traffic was using the number “4” as the signing key along with 7 other keys less than 250. The key is supposed to be a unique number hundreds of binary digits long, but with such a simple key anybody can spoof a certificate that they could claim was signed by eMudhra and CA-checking lists would accept that.
https://www.theregister.com/security/2026/10/20/indian-certification-authority-emudhras-private-keys-compromised-one-of-them-was-the-number-4/5304312
It was discovered that one of India’s Trusted Certificate Authorities, eMudhra, tasked with signing website certificates to verify authenticity of HTTP traffic was using the number “4” as the signing key along with 7 other keys less than 250. The key is supposed to be a unique number hundreds of binary digits long, but with such a simple key anybody can spoof a certificate that they could claim was signed by eMudhra and CA-checking lists would accept that.
At least use a GUID generator website to generate it like the rest of us.
Nerd alert!
Nickname checks out!
You got a lot of downvote for this, lol.
stupid smelly nerds!