eMudhra Revokes Eight More Intermediate CAs Over Key Handling Concerns
Affected customers are moving to replacement certificates as eMudhra exits publicly trusted TLS issuance and awaits an independent review.
Certificate authority eMudhra has revoked eight more intermediate CAs, bringing the total affected to sixteen, after an investigation into its October key compromise. The earlier eight had their ECDSA private keys cut to one byte by a bug in an in-house Python script used during an April 2025 key transfer between hardware security modules, so anyone could recover them. The newly revoked eight are RSA CAs whose keys were not weakened, but the company cannot show their handling met its own certificate practice rules because key material sat in a host process's memory. Six of the new eight issue TLS certificates and two issue code-signing certificates, and the company has moved affected customers to replacement certificates. eMudhra is exiting the publicly trusted TLS business, will stop issuing from its G1 hierarchy by November 16, and expects an independent KPMG review by December 4, while reporting no evidence of malicious use.
Why it matters
The affair shows how a single scripting error during a key transfer can compromise a certificate authority's trust chain, and how weak internal records can turn a cleared suspicion into a revocation. For website operators and software publishers who rely on eMudhra certificates, the change is concrete: their certificates are being replaced and the issuer is leaving the TLS market. Customers of other certificate authorities have a reason to ask how their own providers handle key material, since the company cannot yet show that the RSA keys followed its own rules. The December independent review will show whether the earlier warning sign was an isolated lapse or part of a wider problem.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.