Certificate authority eMudhra has revoked 8 additional intermediate CA certificates following an investigation into improper private key handling during its certificate-generation process, according to Bleeping Computer.
The total number of affected certificates has reached 16. The issue stemmed from a custom Python script used in April 2025 to transfer keys between hardware security modules. A bug in this script reduced 8 ECDSA keys to a single byte, rendering them easily recoverable. Additionally, 8 RSA keys were processed in computer memory rather than within the secure hardware, violating the company's certificate security policies. These RSA certificates were revoked on November 7.
While eMudhra noted that the RSA keys were not weakened, the company could not verify their integrity. The investigation revealed that an earlier warning sign in June 2025 went unaddressed. Major browsers and operating systems, including those from Google, Apple and Microsoft, have since blocked the compromised certificates to prevent potential interception of encrypted communications.
Following the incident, eMudhra announced it will exit the publicly trusted TLS certificate business by November 16 and has commissioned an independent review by KPMG to improve its security procedures. The company reports no evidence of malicious exploitation of the compromised keys.
Source: Bleeping Computer
