Indian CA eMudhra's Compromised Keys Expose Web Infrastructure to Mass Impersonation
Source: The Register: Biting the hand that feeds
eMudhra, one of India's major certificate authorities trusted by browsers to validate website identity, had multiple private keys stolen—including one with the password "4"—enabling attackers to forge SSL certificates for any domain and impersonate banks, government services, and enterprises at scale. The breach is structural, not localized: it compromises India's PKI layer and forces a continent-wide cleanup of trusted certificate stores. It also exposes the gap between regulatory certification requirements and actual operational security practices in emerging markets. Certificate pinning and transparency logs matter here: eMudhra's compromise could have silently poisoned traffic for months without detection had browsers not developed these secondary verification mechanisms.