eMudhra Revokes 8 More CA Certificates, Raising Affected Total to 16

By Olivia Hart

On November 7, eMudhra revoked eight additional intermediate CA certificates, taking the total affected to 16 after an investigation found improper handling of private keys during certificate generation.

The latest revocations covered eight RSA intermediate CA certificates, including intermediates used to issue TLS and code-signing certificates. eMudhra said customer certificates affected by the revocations have been replaced or migrated.

How did the key-transfer script fail?

In an incident report published Tuesday, eMudhra traced both sets of certificates to a custom Python script used in April 2025 to transfer private keys between hardware security modules, or HSMs, at its facilities.

The company built the script to move CA keys between HSMs from different vendors after delays in obtaining new hardware. HSMs are designed to generate and store cryptographic keys while preventing sensitive private material from leaving the protected device.

The script’s impact split into two groups:

• Eight ECDSA intermediate CA private keys were reduced to a single byte. Anyone could recover them almost instantly by testing just 256 possible values.
• The same script processed eight RSA intermediate CA private keys. They were not weakened, but their sensitive information sat in the memory of the computer running the process rather than inside the HSM.

eMudhra said it could not demonstrate that it had handled the RSA keys under its certificate security policies. Its incident report stated:

“A re-import performed from host process memory is not consistent with the CPS §6.2.6 and the RSA objects are therefore treated as not meeting that requirement.”

That policy failure triggered the November 7 revocations. Some affected RSA intermediates had been actively issuing certificates since May 2026, with the last affected certificate issued on November 3.

What warning signs did eMudhra miss?

The investigation found that an earlier problem in June 2025 could have revealed the flaw more than a year before a security researcher known as “Wayne” discovered it.

At the time, eMudhra detected certificate revocation lists signed with private keys that did not match the corresponding CA certificates. The company fixed the issue by signing the lists with matching keys, but did not investigate why the problem occurred.

The new report confirms that the mismatch was an early warning sign of the faulty key-generation process, which went undetected until October 2026. eMudhra also failed to verify the strength of generated private keys or check that the keys used for certification matched those originally created in the HSM.

Wayne disclosed the original issue on October 17, 2026, after finding that eight eMudhra intermediate CA private keys could be recovered by testing 256 possible values. Major browsers and operating systems trusted the compromised certificates, potentially allowing attackers to forge certificates for legitimate websites and intercept encrypted communications.

Mozilla, Google, Apple and other software vendors subsequently released protections to block the compromised certificates. On October 26, Microsoft released out-of-band Windows updates to remove trust in affected eMudhra certificate chains on systems that could not receive automatic certificate trust updates.

What does this change for certificate customers?

eMudhra plans to stop issuing certificates under its remaining G1 hierarchy by November 16. It has also announced that it will exit the publicly trusted TLS certificate business and transition its remaining customers to another provider.

For customers, the change is concrete: eMudhra is replacing affected certificates, moving remaining customers to another provider, and ending issuance under the G1 hierarchy.

eMudhra has commissioned KPMG to conduct an independent review of its certificate-management and key-generation procedures, with findings expected by December 4. The company says it has not detected any evidence that the compromised keys were used maliciously.

The affected certificates have been replaced or migrated; KPMG’s findings, expected by December 4, will set out the improvements eMudhra still needs to make.