In a recent development, eMudhra has withdrawn eight more intermediate certificate authorities (CAs) following an in-depth review of a significant security issue that emerged in October. This action brings the total number of revoked certificates to sixteen.
Background on the Security Incident
On April 30, 2025, eMudhra first encountered a key management problem. Although these keys were initially generated correctly within a hardware security module (HSM), a custom Python script used in the process compromised their integrity. The script inadvertently reduced the size of eight keys to small numbers, rendering them vulnerable to brute force attacks.
Details of the Revocation
The Mozilla public bug report revealed that the affected P-384 private keys were much smaller than required, making them easily guessable. Additionally, an oversight in the script led to the duplication of eight other keys within a computer’s memory. While these remained strong, eMudhra could not confirm their secure handling per internal policies, prompting the revocation of all sixteen certificates.
Industry Response and Future Measures
Following the discovery by researcher Wayne, major tech companies including Mozilla, Chrome, and Microsoft took swift action to block the compromised certificates. By October 22, eMudhra announced its withdrawal from the global SSL/TLS certificate market, assuring no data breach occurred, and that the affected intermediates had not issued any website certificates.
eMudhra has since revised its revenue projections and engaged KPMG for an external review. Furthermore, browsers like Mozilla and Chrome have begun removing trust in certain eMudhra roots, with Microsoft planning further removals starting November 16.
Conclusion and Recommendations
The case underscores the importance of rigorous key management and testing protocols. As a precaution, users are advised to update their browsers and operating systems. Administrators should monitor upcoming changes, particularly Microsoft’s updates, to ensure continued security. This incident highlights how even minor script errors can severely compromise digital certificate security.
