eMudhra revokes 8 additional intermediate CA certificates in private key mishandling aftermath
Certificate authority eMudhra has revoked eight more intermediate CA certificates after its investigation into a certificate security incident revealed improper private key handling during the certificate generation process. This brings the total affected intermediate CAs to sixteen, including eight previously compromised ECDSA keys that were extremely weak and easily recoverable. The root cause was a flawed Python script used to transfer keys between hardware security modules (HSMs), which reduced ECDSA keys to a single byte and exposed RSA keys outside the HSM memory protection. Although the RSA keys were not cryptographically weakened, their handling violated eMudhra's security policies, leading to their revocation. The compromised certificates were actively used to issue TLS and code-signing certificates, and customer certificates have been replaced or migrated. Major browsers and OS vendors have blocked the affected certificates. eMudhra will exit the publicly trusted TLS certificate business and commissioned an independent review to improve its key management practices. No evidence of malicious use of compromised keys has been found so far.
Linha do tempo
-
eMudhra revokes 8 additional intermediate CA certificates in private key mishandling aftermath
ler a análise desta fonte ocultar
Certificate authority eMudhra has revoked eight more intermediate CA certificates after its investigation into a certificate security incident revealed improper private key handling during the certificate generation process. This brings the total affected intermediate CAs to sixteen, including eight previously compromised ECDSA keys that were extremely weak and easily recoverable. The root cause was a flawed Python script used to transfer keys between hardware security modules (HSMs), which reduced ECDSA keys to a single byte and exposed RSA keys outside the HSM memory protection. Although the RSA keys were not cryptographically weakened, their handling violated eMudhra's security policies, leading to their revocation. The compromised certificates were actively used to issue TLS and code-signing certificates, and customer certificates have been replaced or migrated. Major browsers and OS vendors have blocked the affected certificates. eMudhra will exit the publicly trusted TLS certificate business and commissioned an independent review to improve its key management practices. No evidence of malicious use of compromised keys has been found so far.