Certificate authority (eMudhra) generated eight of its intermediate signing keys so badly that anyone can recover the private keys from the public certificates. That means anyone can mint a "valid" HTTPS certificate for any site, such as your bank, GitHub, or PyPI, and impersonate it.
Certificate authority (eMudhra) generated eight of its intermediate signing keys so badly that anyone can recover the private keys from the public certificates. That means anyone can mint a "valid" HTTPS certificate for any site, such as your bank, GitHub, or PyPI, and impersonate it.
Much better explanation here
https://cycle.io/blog/2026-intermediate-ca-compromise
This is the Go version of the initial HN post https://news.ycombinator.com/item?id=50166579