An Indian certificate authority trusted by every major browser had a private key with the value 4. Not “weak” in the password-manager sense — the integer 4. A P-384 ECDSA key that should carry around 384 bits of entropy was reduced to a single digit. Security researcher Scott Helme cracked all eight compromised keys on a personal laptop in under a second. An AI agent later did it from one prompt. eMudhra, the CA responsible, is exiting the publicly trusted TLS business entirely — the last certificates issue today. What Went Wrong in April 2025 The failure traces to a […]
The post