On October 21, it came to light that the Indian Certificate Authority (CA) organization, eMudhra, had a significant flaw in the generation of private keys for eight intermediate certificates it issued. The entropy—or randomness—in these private keys was alarmingly low, rendering them vulnerable to being cracked in under a second. Malicious actors could leverage this vulnerability to forge trusted HTTPS certificates, initiate man-in-the-middle attacks, and intercept user communications. This security breach originated from implementation mistakes within eMudhra's certificate generation process, rather than from an external security breach.

Presently, leading global browsers, software vendors, and mainstream development languages and frameworks have all implemented updates to block the compromised certificates. eMudhra has also formally revoked these flawed certificates. Although there is currently no evidence of these vulnerable private keys being maliciously exploited, the proliferation of IoT devices and outdated systems that have not been promptly updated means that it will take some time to completely mitigate the underlying risks.