eMudhra revokes 8 more CAs after RSA keys left HSMs
Original title: eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise
It cannot prove the eight RSA issuer keys complied with its HSM rules, and lists 195 affected certificates.
eMudhra revoked eight intermediate CAs late last week after concluding a Python script had read their RSA private keys out of Utimaco HSMs into a ceremony computer on April 30, 2025. The company had told Mozilla on October 19 that those issuers were unaffected. Six issued TLS certificates and two issued code-signing certificates; holders have been moved to new certificates. eMudhra says it knows of no misuse. Microsoft plans to start removing 10 remaining eMudhra roots on November 16.
Unconfirmed: eMudhra knows of no misuse; whether the October weak keys were used against non-CT software is unknown.
- The company lists 195 certificates, 29 of them for its own domains.
- RSA CAs were revoked as cessationOfOperation, not with the keyCompromise code.
- Four of the eight CAs were put into production in May.
- KPMG's review is due by December 4; the CA key inventory is due November 30.
- G1 hierarchy issuance is due to stop before November 16.
Impact: CA private keys sat in ceremony-computer memory outside HSMs
| Product | Affected |
|---|---|
| eMudhra emSign intermediate CAs | — |
- 1.Search the company list or Certificate Transparency logs for revoked G2C TLS issuers
- 2.Plan for Microsoft removing remaining eMudhra roots starting November 16
- Products
- emSign
From the original article
5 min read at thehackernews.com
The in-house Python script behind eMudhra's October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys. Each intermediate CA has its own private key, which the company uses to sign the certificates it issues. The 8 intermediate CAs compromised in October had a different problem: a single line in the script
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.