eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise
The in-house Python script behind eMudhra's October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys. Each intermediate CA has its own private key, which the company uses to sign the certificates it issues. The 8 intermediate CAs compromised in October had a different problem: a single line in the script
eMudhra, a certificate authority provider, has revoked eight additional intermediate certificate authorities (CA) that it had previously deemed unaffected by a key compromise discovered in October. The company's in-house Python script, responsible for transferring keys between hardware security modules (HSMs), is to blame for the latest issue.
On April 30, 2025, the script cut the private key of eight intermediate CAs to one byte, while transferring them between HSMs of different vendors. The script also retrieved the RSA keys of the eight newly compromised CAs from the HSMs. The company cannot confirm that the keys were handled in accordance with its own rules, as logs and files from the ceremony computer cannot reliably demonstrate how the material was handled.
The company must revoke these CAs because their private parts, such as the private exponent and one of the primes, were in the memory of a Python process on the ceremony computer, violating its own certificate policy (CPS) §6.2.6 regarding key movement. The company plans to publish its inventory of all CA keys by December 4 and complete the review process by November 30.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
