A MAJOR HTTPS COMPROMISE eMudhra TLS intermediate certificates were found to be compromisable because they didn't bother to use random numbers. Web browsers rely on TLS certificates for HTTPS traffic. Your web browser needs the intermediate certificate to verify that, when you connect to a domain, it's real and not someone spoofing it along the TCP/IP route from your computer, Wi-Fi, ISP, to the web server. Intermediaries are trusted parties who are given the private keys to issue TLS certificates for domains. If the certificate key is compromised, anyone can issue a fake TLS certificate, tap the traffic, and listen to your Internet traffic because it is no longer end-to-end encrypted. A malicious party can read your passwords, messages, and all your online life. For example, eMudhra, with its intermediary keys, can give a "facebook.com" domain certificate for anyone, and after this, the party can wiretap your Facebook traffic. eMudhra is India’s largest Certifying Authority, employs about 600-850 staff and generates roughly $70M in annual revenue. Its main lines are enterprise identity and cybersecurity platforms, digital signature and trust services, and related consulting. Each certificate's private key was a random number between 1 and 256. Yes 256. Not 256 bits but two hundred fifty. Modern web browsers follow revocation lists and automatically stop trusting anything signed by eMudhra. But web browsers are only one part of Internet-connected software. Operating systems, development libraries, Internet of Things devices and generally anything with an Internet connection are all affected, unless its auto-updating authority has issued an emergency fix.