Science & Tech · Cybersecurity · 2 hrs ago
eMudhra revokes eight more certificate authorities after key-handling flaw
eMudhra has revoked eight more intermediate certificate authorities, bringing the total affected by its security incident to 16.
The problem began in April 2025, when a company-made Python script moved private keys between hardware security devices.
A bug reduced eight earlier keys to a single byte, making them easy to recover, while eight additional RSA keys were handled in computer memory rather than kept protected in the devices.
eMudhra says it could not show that those RSA keys met its security rules, though it did not say they had been weakened in the same way.
Some of the affected authorities had issued website and code-signing certificates, and eMudhra says customer certificates have been replaced or moved to another provider.
Major browsers and operating systems blocked the compromised certificates because attackers could potentially use them to impersonate websites or intercept encrypted communications.
eMudhra plans to leave the publicly trusted TLS certificate business and stop issuing certificates under its remaining G1 hierarchy by November 16, while an independent KPMG review is expected by December 4.
eMudhra revoked eight more intermediate certificate authority certificates after finding that a Python script exposed their private keys to a computer’s memory.
The additional certificates bring the total affected to 16, including eight ECDSA certificates whose keys were reduced to a single byte.
The company said it could not show that the eight RSA keys were handled according to its security rules, although their keys were not weakened in the same way.
The key-handling problems began during a transfer between hardware security modules on April 30, 2025.
eMudhra revoked the additional certificates on November 7 and says affected customer certificates have been replaced or migrated.
- Who
- eMudhra, a certificate authority, revoked eight additional intermediate certificates.
- What
- The company found that a Python script mishandled private keys during transfers between hardware security modules.
- When
- The certificates were revoked on November 7, 2026; the key-transfer process took place on April 30, 2025.
- Where
- The key ceremony took place at eMudhra; the keys were intended for hardware security modules at its US and EU sites.
- Why
- eMudhra could not show that the RSA keys were handled under its certificate security policies.
This story does not have two clearly opposing sides.
eMudhra generated 16 CA keys on Utimaco hardware security modules and used a Python script during a transfer practice run.
eMudhra found certificate revocation lists signed with keys that did not match the corresponding CA certificates and corrected the signatures without investigating the cause.
The incident was first disclosed after security researcher Wayne found that eight intermediate CA private keys could be recovered by testing 256 possible values.
eMudhra revoked eight additional RSA intermediate CA certificates.
eMudhra published its incident report describing the key-handling problems.
- Affected intermediates
- 16 in total, including eight previously compromised certificates and eight additional RSA certificates
- Additional revocations
- Eight RSA intermediate CA certificates
- Key transfer date
- April 30, 2025
- Revocation date
- November 7, 2026
- RSA certificate uses
- Six for website TLS certificates and two for code signing
3 sources
What people are saying
A re‑import performed from host process memory is not consistent with the CPS §6.2.6 and the RSA objects are therefore treated as not meeting that requirement
The RSA issuers went through a different path as per our assessment of the code and are therefore not impacted,