eMudhra revokes 8 more CA certificates after private-key mishandling
Original title: eMudhra revokes 8 more CA certificates after private key mishap
A buggy key-transfer script reduced eight ECDSA keys to one byte and left eight RSA keys outside HSM policy.
Certificate authority eMudhra revoked eight more intermediate CA certificates on November 7 after finding a custom Python script mishandled private keys while moving them between HSMs in April 2025. That brings the total to 16 intermediates, including eight ECDSA keys so weak they could be recovered by trying 256 values. The new set covers RSA intermediates used for TLS and code signing; some issued certificates from May 2026 through November 3. eMudhra says customer certificates were replaced or migrated, it will stop issuing under the remaining G1 hierarchy by November 16, and it has not seen malicious use of the keys.
Unconfirmed: eMudhra says it has not detected malicious use of the compromised keys.
- The RSA keys were processed in host memory, not kept inside the HSM.
- Browsers and Microsoft blocked the earlier compromised chains after the October 17 disclosure.
- A June 2025 CRL mismatch was an early sign that went uninvestigated.
- KPMG’s independent review is expected by December 4.
- eMudhra plans to exit the publicly trusted TLS certificate business.
Impact: Recoverable CA keys could forge trusted TLS or code-signing certificates
| Product | Affected |
|---|---|
| eMudhra intermediate CA certificates | 16 intermediates, including eight RSA certificates revoked November 7 |
- 1.Replace or migrate certificates issued by the revoked eMudhra intermediates.
- 2.Treat the remaining eMudhra G1 hierarchy as ending certificate issuance on November 16.
- Vendors
- eMudhra
From the original article
3 min read at bleepingcomputer.com
Certificate authority eMudhra has revoked eight additional intermediate CA certificates after an investigation into its recent certificate security incident found improper handling of private keys during the certificate-generation process. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.