When you visit a website, send an email, etc. your data is encrypted using an organisation's public key. A certificate is just a special file that says the public key you're using is owned by X organisation - a Microsoft website, if it's legit, should have a key registered by Microsoft.

To prevent someone minting a fake certificate from eMudhra, the were expected to add a special signature, basically some encrypted data that you can decrypt with their public key that proved a certificate was created by eMudhra. Otherwise, anyone could say their website is owned by eg. Microsoft, and you would probably trust it!

It's like the little holographic marks on physical money; really easy for the issuing authrority to create, but (ideally!) impossible for an untrusted person to copy. And for the most part, no one needs to verify it (this is what we call trust).

There are meant to be 2^384^ (>100 digit number, more atoms in the universe??? or some other comically large number) combinations of these holographic marks.

You'd need a super computer generating numbers for years to generate the same one held by eMudhra. Well, if they didn't actually only have just 256 combinations of this mark. It took researchers miliseconds to crack them.