eMudhra revokes 8 more CA certificates after private key mishap
eMudhra revokes 8 more CA certificates due to improper private key handling.
Certificate authority eMudhra has revoked eight additional intermediate CA certificates, bringing the total to 16, due to improper handling of private keys during certificate generation. A custom Python script used to transfer keys between HSMs contained a bug that weakened ECDSA private keys and mishandled RSA private keys. The company could not demonstrate that the RSA keys met its security policies, leading to their revocation. An earlier incident in June 2025, where CRLs were signed with mismatched keys, was identified as an early warning sign of this faulty process.
AI summary of the linked source. Not reviewed by an editor. How this works
Run eMudhra?
Get an email when a new story names eMudhra, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessoneMudhra's use of a custom Python script to transfer private keys between Hardware Security Modules (HSMs) introduced a critical bug that weakened ECDSA keys and mishandled RSA keys, ultimately undermining the cryptographic integrity of 16 intermediate CA certificates. The root cause was inadequate validation and testing of the key migration tooling before it was used in production on highly sensitive cryptographic material. A missed early warning — CRLs signed with mismatched keys in June 2025 — shows that existing monitoring failed to flag a serious process failure in time. This incident matters because compromised CA private keys can enable the issuance of fraudulent certificates, eroding trust across the entire PKI ecosystem that relies on eMudhra as a trusted authority.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.