eMudhra revokes 8 more CA certificates after private key mishap

Certificate authority eMudhra has revoked eight further intermediate CA certificates after an investigation into its recent certificate security incident found improper handling of private keys during the certificate-generation process.

The new revocations bring the total number of affected intermediate CA certificates to 16, including eight previously compromised certificates whose private keys were so weak that anyone could recover them almost instantly.

In a new incident report published Tuesday, eMudhra said that both sets of certificates were affected by a custom Python script used to transfer private keys between hardware security modules (HSMs) in April 2025.

eMudhra says it developed the script to move certificate authority keys between different HSM vendors at its facilities after delays in obtaining new hardware.

Some of the affected RSA intermediates had been actively issuing certificates since May 2026, with the last certificate issued on November 3.

The new report confirms this was an early warning sign of the faulty key-generation process that went undetected until October 2026.

HSMs are devices designed to securely generate and store cryptographic keys, preventing sensitive private keys from being exposed outside the hardware.

eMudhra says the affected customer certificates have also been replaced or migrated.

While the RSA keys were not weakened like the original eight certificates, eMudhra says it could not demonstrate that it handled them under its certificate security policies.

As BleepingComputer previously reported, the incident was first disclosed on October 17, when a security researcher named Wayne discovered that eight eMudhra intermediate CA private keys could be recovered by testing just 256 possible values.

The company fixed the issue by signing the revocation lists with the matching keys but did not investigate why the problem occurred.

The investigation also found that eMudhra did not verify the strength of generated private keys or check that the keys used for certification matched those originally created in the HSM.

Mozilla, Google, Apple, and other software vendors afterward released protections to block the compromised certificates.

Microsoft also released out-of-band Windows updates on October 26 to remove trust in affected eMudhra certificate trust chains on systems that could not receive automatic certificate trust updates.