Overview
Certificate authority eMudhra has revoked eight additional intermediate CA certificates following a security incident where improper handling of private keys led to compromised certificates. The incident involved a custom Python script used to transfer private keys between hardware security modules (HSMs).
Detailed Investigation
The investigation found that a custom Python script used to move private keys between HSMs in April 2025 contained a bug that reduced eight ECDSA private keys to a single byte, making them extremely easy to recover. The same script also processed eight RSA private keys, which were not weakened but were handled insecurely in memory.
Impact and Response
The affected intermediate CA certificates now total 16, including eight previously compromised certificates. eMudhra revoked the additional eight RSA intermediate CA certificates on November 7, including those used for issuing TLS and code-signing certificates. Some of the affected RSA intermediates had been actively issuing certificates since May 2026, with the last certificate issued on November 3. eMudhra also replaced or migrated the affected customer certificates.
Security Measures
Major browsers and operating systems blocked the compromised certificates, potentially allowing attackers to forge certificates for legitimate websites and intercept encrypted communications. eMudhra announced it would exit the publicly trusted TLS certificate business and transition its remaining customers to another provider. The company commissioned an independent review by KPMG to identify improvements to its certificate management and key-generation procedures.
Conclusion
The incident highlights the importance of secure key management and the need for rigorous security policies and procedures to prevent such vulnerabilities from occurring in the future. eMudhra's response underscores the importance of thorough investigations and swift remediation in the face of security incidents.
Comments