certificate forgery

Weak crypto in eight eMudhra keys opens a door for certificate forgery

Eight eMudhra certificate keys were compromised through low entropy, not a breach. That distinction matters: attackers forged certificates for any site, and browsers had to lean on revocation lists while other software removed the emSign ECC G3 root entirely. Unpatched systems still face exposure, including client auth and mTLS. Certificate security depends on randomness, and this shows what happens when it fails. For more on how exposed credentials enable rogue access, our coverage of India's cloud defenses offers a useful parallel.