Network · 1 day ago
eMudhra revoked eight additional intermediate certificate authorities after finding its hardware security module (HSM) transfer script had read their RSA private keys into computer memory. The company had previously said these CAs were unaffected; six issued website certificates and two issued code-signing certificates.
The script copied keys out of the HSM and rebuilt them from that copy on the ceremony computer. eMudhra says the keys were not weakened, but it could not show they had remained within required handling controls, so it revoked the CAs. Its list includes 195 certificates issued under them, 29 for eMudhra domains.
If a website or software package relies on one of those intermediates, revocation can affect whether its certificate is trusted. That extends the incident from the key-transfer process to certificates already in use, including eMudhra’s own domains.
3 sources covering this story
Disgraced former CA eMudhra blames buggy script for hopelessly weak certificates
Couldn’t get the hardware it needed to generate certs, so tried to code a workaround
eMudhra revokes 8 more CA certificates after private key mishap
Certificate authority eMudhra has revoked eight additional intermediate CA certificates after an investigation into its recent certificate security incident found improper handling of private keys during the certificate-generation process.
eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise
eMudhra revoked 8 more certificate authorities after finding its Python script exposed RSA private keys to process memory during an HSM transfer.
Part of the PlainSec briefing for 2026-11-13