eMudhra has revoked eight additional intermediate CA certificates after an investigation into its certificate security incident found improper handling of private keys during certificate generation. The new revocations bring the total affected intermediate CA certificates to 16, and the company says the incident also exposed an earlier warning sign that went unchecked for more than a year.
Additional certificate revocations
The newly revoked set consists of eight RSA intermediate CA certificates. eMudhra said these were handled by the same custom Python script that moved private keys between hardware security modules, or HSMs, in April 2025 after delays in obtaining new hardware. The company developed the script to move certificate authority keys between different HSM vendors at its facilities.
The report says the script had two different failures. It reduced eight ECDSA private keys to a single byte, which made them easy to recover, and it also processed eight RSA private keys in the memory of the computer running the script instead of keeping them inside the HSM. eMudhra said it could not show that the RSA keys were handled under its certificate security policies, and the incident report said a re-import from host process memory did not meet CPS section 6.2.6.
The additional revocations took place on November 7. Some of the affected RSA intermediates had been issuing certificates since May 2026, and the last certificate was issued on November 3. The affected customer certificates have also been replaced or migrated.
Early warning signs in June 2025
The investigation also traced the problem back to June 2025, when eMudhra saw certificate revocation lists signed with private keys that did not match the corresponding CA certificates. The company corrected that by signing the revocation lists with matching keys, but it did not look into why the mismatch happened. The new report says that event was an early warning sign of the faulty key-generation process that remained undetected until October 2026.
The company also found that it did not verify the strength of generated private keys or confirm that the keys used for certification matched the ones originally created in the HSM. That gap left the faulty process in place until the later discovery by a security researcher known as Wayne.
Browser and vendor protections
The incident was first disclosed on October 17, when Wayne found that eight eMudhra intermediate CA private keys could be recovered by testing only 256 possible values. Because major browsers and operating systems trusted the compromised certificates, attackers could have forged certificates for legitimate websites and intercepted encrypted communications.
Mozilla, Google, Apple, and other software vendors later released protections to block the compromised certificates. Microsoft also issued out-of-band Windows updates on October 26 to remove trust in affected eMudhra certificate trust chains on systems that could not receive automatic certificate trust updates.
eMudhra says it will exit the publicly trusted TLS certificate business and move its remaining customers to another provider. The company plans to stop issuing certificates under its remaining G1 hierarchy by November 16, and it has commissioned an independent review by KPMG with findings expected by December 4 to identify improvements to certificate management and key-generation procedures. The company says it has not found evidence that the compromised keys were used maliciously.
Licensed under CC BY-ND 4.0 International