GoKawiileMudhra certificate authority keys found to be trivially weak numbers like 4 and 56
A security researcher discovered that eight eMudhra intermediate certificate authority private keys, including six TLS issuing CAs and two code-signing CAs created in April 2025, were generated as tiny single-digit or small numbers rather than proper random 384-bit values. Browser vendors moved quickly: Chrome blocked the certificates via a CRLSet update and Mozilla followed via OneCRL, with Mozilla later shipping an NSS update to remove the eMudhra root and Chrome confirming removal in its Root Store v43.