GoKawiileMudhra revokes 8 more intermediate CA certificates over key-handling flaw
eMudhra has revoked eight additional intermediate CA certificates after finding that a custom Python script used to move private keys between hardware security modules exposed RSA key material in computer memory rather than keeping it inside the HSM. This brings the total to 16 revoked certificates, including eight earlier ones whose ECDSA private keys were weakened to a single byte by a bug in the same script. The RSA certificates, some of which had been issuing TLS and code-signing certificates since May 2026, were revoked on November 7 because eMudhra could not confirm they met its certificate security policy requirements.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident highlights how a single scripting error during routine HSM migration can cascade into a widespread trust failure across a certificate authority's issuance chain, affecting both TLS and code-signing certificates relied on across the internet. Because intermediate CA revocations can invalidate downstream certificates, organizations using eMudhra-issued certificates may need to urgently verify and reissue affected credentials. The episode could also prompt browser and OS vendors to scrutinize eMudhra's compliance with certificate security standards more closely going forward.
- eMudhra revoked 8 more intermediate CA certificates, bringing total revocations to 16.
- A faulty Python script used for HSM key migration exposed RSA private keys in computer memory, violating certificate security policy.
- Some affected certificates had been actively issuing TLS and code-signing certificates since May 2026 before revocation on November 7.
Source: bleepingcomputer.com, 2026-11-11
Published there as: “eMudhra revokes 8 more CA certificates after private key mishap”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.