eMudhra has announced the revocation of eight additional intermediate certificate authorities (CAs) due to a key compromise, despite initially declaring them unaffected. This development stems from a flaw in a Python script used during a key ceremony, which inadvertently truncated each key to a single byte.
Details of the Key Compromise
The issue was traced back to an event on April 30, 2025, where the company generated 16 CA keys using Utimaco hardware security modules (HSMs). These keys were intended for use in Crypto4A HSMs across eMudhra’s US and EU sites. A Python script was employed to facilitate the transfer of these keys, which inadvertently truncated the private keys for the eight affected CAs.
Despite the flaw, the certificates issued using these keys continued to produce valid signatures and went unnoticed through multiple audit cycles. The problem became apparent when invalid CRL signatures emerged in June 2025, prompting further investigation.
Impact on Certificate Holders
Among the revoked CAs were those responsible for issuing website (TLS) and code-signing certificates. eMudhra has moved all affected certificate holders to new certificates. The initial announcement of unaffected status was based on incomplete information, as the script’s behavior was not fully understood at that time.
KPMG, an independent reviewer, has been engaged to assess the situation, with a report expected by December 4. eMudhra maintains that no evidence of misuse has been found, although the potential for impersonation using the compromised keys existed.
Future Implications and Industry Response
Following these revelations, eMudhra is exiting the publicly trusted TLS business. Certificate Transparency logs and other tools are available for holders to verify affected certificates. Major browsers and operating systems are adjusting their trust policies accordingly. Microsoft plans to remove remaining eMudhra roots from its products by November 16, while Apple, Chrome, and Firefox have outlined similar timelines for ceasing trust in compromised certificates.
The incident underscores the critical importance of robust key management processes and the potential risks associated with script errors in sensitive operations.
