A Company Trusted With Internet Security Had a Secret Key: 4

On Saturday, 17 October, a security researcher known as Wayne was scanning public certificate data, the kind that anyone can look at. Eight certificates from an Indian company called eMudhra looked wrong. The secret numbers behind them were supposed to be huge and random. They were tiny, and one of them was 4.

Access without a medium partner here: eMudhra Security Issue

Just the digit 4, sitting where a number about 116 digits long should have been.

Within hours, Chrome and Firefox had blocked the certificates. By Thursday, eMudhra had announced it was quitting the business of issuing website certificates, and its shares had dropped about 40% in two days. All of it goes back to one ceremony on 30 April 2025.

What a private key actually is

When you open your bank's website, your browser has to be sure it's talking to the real bank and not a fake copy. It can't work that out alone. So browser makers keep a list of companies they trust to vouch for websites, and those companies are called certificate authorities, or CAs. eMudhra is a Bengaluru company licensed by India's Controller of Certifying Authorities, and its certificates have sat in browser trust lists since mid-2025.