Imagine you get a message asking you to pay a bill online. You click the link, the website looks genuine, and your browser shows a secure connection. So, you go ahead and enter your details. But what if something is wrong with the system that helps your browser check whether a website is real or fake? That’s the concern behind the eMudhra security incident. Eight digital certificates linked to the Indian company’s global website-security business were found to have extremely weak private keys. This raised concerns that cybercriminals could potentially use them to create fake websites that look genuine and trick browsers into trusting them.
Google, Mozilla, Apple and Microsoft were alerted to the issue, and browser companies moved to block the affected certificates. However, eMudhra says the certificates had not been used to issue customer certificates, its infrastructure was not compromised, and no data breach occurred.
