Disgraced former CA eMudhra blames buggy script for hopelessly weak certificates

eMudhra, a trusted certificate authority, issued digital certificates with critically weak single-byte private keys because a custom Python script incorrectly truncated key values during generation. The root cause was a decision to substitute a homegrown script for a proper Hardware Security Module (HSM) — the gold-standard tooling required for certificate issuance — after claiming supply chain constraints made HSMs unavailable. This matters enormously because certificates issued by a CA form the backbone of public trust on the internet; weak keys can be trivially broken, undermining the security of every relying party. The incident demonstrates that operational workarounds in cryptographic pipelines must never bypass mandatory controls, and that supply chain constraints are not an acceptable justification for weakening fundamental security guarantees.