eMudhra revokes 8 more CA certificates after private key mishap

Lawrence Abrams

November 11, 2026
04:27 PM
0

Certificate authority eMudhra has revoked eight additional intermediate CA certificates after an investigation into its recent certificate security incident found improper handling of private keys during the certificate-generation process.

The new revocations bring the total number of affected intermediate CA certificates to 16, including eight previously compromised certificates whose private keys were so weak that anyone could recover them almost instantly.

In a new incident report published Tuesday, eMudhra said that both sets of certificates were affected by a custom Python script used to transfer private keys between hardware security modules (HSMs) in April 2025.

HSMs are devices designed to securely generate and store cryptographic keys, preventing sensitive private keys from being exposed outside the hardware.

eMudhra says it developed the script to move certificate authority keys between different HSM vendors at its facilities after delays in obtaining new hardware.

However, the script contained a bug that reduced eight ECDSA private keys to a single byte, making them extremely easy to recover.

The same script also processed eight RSA private keys, which handled sensitive key information in the memory of the computer running the script rather than keeping it protected within the HSM.

While the RSA keys were not weakened like the original eight certificates, eMudhra says it could not demonstrate that it handled them under its certificate security policies.

"A re‑import performed from host process memory is not consistent with the CPS §6.2.6 and the RSA objects are therefore treated as not meeting that requirement," reads the incident report.

Due to this, the company revoked the additional eight RSA intermediate CA certificates on November 7, including certificates used to issue TLS and code-signing certificates.

Some of the affected RSA intermediates had been actively issuing certificates since May 2026, with the last certificate issued on November 3.

eMudhra says the affected customer certificates have also been replaced or migrated.

The investigation also found that an earlier problem in June 2025 could have revealed the flaw more than a year before it was discovered by a security researcher known as "Wayne."

At that time, eMudhra detected certificate revocation lists (CRLs) signed with private keys that did not match the corresponding CA certificates.

The company fixed the issue by signing the revocation lists with the matching keys but did not investigate why the problem occurred.

The new report confirms this was an early warning sign of the faulty key-generation process that went undetected until October 2026.

The investigation also found that eMudhra did not verify the strength of generated private keys or check that the keys used for certification matched those originally created in the HSM.

Major browsers blocked compromised certificates

As BleepingComputer previously reported, the incident was first disclosed on October 17, when a security researcher named Wayne discovered that eight eMudhra intermediate CA private keys could be recovered by testing just 256 possible values.

Major browsers and operating systems trusted the compromised certificates, potentially allowing attackers to forge certificates for legitimate websites and intercept encrypted communications.

Mozilla, Google, Apple, and other software vendors subsequently released protections to block the compromised certificates.

Microsoft also released out-of-band Windows updates on October 26 to remove trust in affected eMudhra certificate trust chains on systems that could not receive automatic certificate trust updates.

Following the incident, eMudhra announced that it would exit the publicly trusted TLS certificate business and transition its remaining customers to another provider.

The company says it plans to stop issuing certificates under its remaining G1 hierarchy by November 16.

eMudhra has also commissioned an independent review by KPMG, with findings expected by December 4, to identify improvements to its certificate management and key-generation procedures.

The company says it has not detected any evidence that the compromised keys were used maliciously.