Blog

A Certificate Authority's Bad Week A certificate authority named eMudhra spent years building the kind of trust that's supposed to be permanent. Browsers, operating systems, and websites relied on eMudhra's signature to confirm that a connection was safe. Then a private key tied to four of its certificates got compromised, and major browsers moved to stop trusting anything signed by that authority going forward.

A Certificate Authority Just Lost Its License to Be Trusted Browsers don't send out press releases when they stop trusting a company. They just quietly stop trusting them, and that's roughly what happened to eMudhra this year. The certificate authority, which issued TLS certificates that tell your browser a website is actually who it claims to be, got caught misusing a private key in a way that violated the baseline rules every CA agrees to follow.

Meta moved its Commercial Terms update to Nov 20, 2026. Here’s what the crawl clause says after “train” was removed — and a plain checklist (not legal advice).

A Single Failure, A Week of Headlines A single certificate authority in India got caught issuing a fraudulent Microsoft code-signing certificate, and within days you had technical outlets dissecting how certificate chains get exploited, security researchers writing about what it means for software supply chain trust, business publications asking what liability certificate authorities actually carry when this happens, and industry analysts using it as a case study for why browser vendors are tigh

Why Trust Signals Are Having a Moment A certificate authority just got kicked out of the TLS business. eMudhra, one of the companies that issues the digital certificates that make the padlock icon in your browser mean something, had a private key tied to one of its customers misused. The response from the browser makers and the CA/Browser Forum wasn't a warning or a fine.

When Trust Breaks Overnight Did you notice the internet quietly flinched a few weeks ago? A certificate authority — one of the entities browsers trust to vouch that a website is actually who it claims to be — got pulled from the TLS ecosystem after the kind of security lapse that undermines the entire reason a CA exists. One day it's a trusted root.

A Private Key Problem A certificate authority's entire business is trust. eMudhra sells the digital equivalent of a notarized signature — the private keys and certificates that prove a website, a document, or a piece of software is who it claims to be. So when browser makers started pulling trust in eMudhra's root certificates after key management failures came to light, the irony landed hard.

When Trust Infrastructure Quietly Breaks Do you know what happens to a company whose entire business model depends on being automatically trusted by millions of browsers, the second that trust gets pulled? eMudhra is a certificate authority based in India. Its job, like every certificate authority, was to vouch for websites so your browser could show that little padlock icon without you having to think about it.

A Four-Digit Key and a Broken Chain of Trust Every browser on your computer trusts a short list of companies to vouch for the websites you visit. That trust is called a certificate authority, and the whole system runs on one assumption: the authority's private key stays private. Eyeball CA eMudhra found out what happens when that assumption breaks.

The Metric That Misleads You Are you checking click-through rate after every post and wondering why your "best" content never seems to show up there? Click-through rate was built to measure one thing: did someone see a link and tap it right then. That's a fine metric for a paid ad trying to get someone to a landing page in the next ten seconds.