eMudhra Revokes 8 Intermediate CAs Following Key Handling Flaws Despite No Key Weakness
eMudhra's recent incident involves the revocation of 8 intermediate CAs after a Python script used during a key ceremony improperly handled private keys, leading to potential security concerns. Although the keys were not weakened cryptographically, the company cannot demonstrate that private key material was managed in compliance with their policies. The incident traces back to a mistake during a key transfer process, where private keys were read into memory, risking exposure. Despite the absence of malicious misuse, browsers and certificate authorities are removing trust from affected certificates.
Detalhes técnicos
The incident stems from a flaw in an in-house Python script used during a key ceremony on April 30, 2025. The script read private RSA keys from HSMs into memory and rebuilt them for transport, which, due to a coding error, truncated the private key values for 8 CAs. Although these keys still generated valid signatures, the process did not meet the company's policy requirements for handling private key material, leading to their revocation. The company conducted a detailed incident review after detecting invalid CRL signatures in June 2025.
Detalhes da correção
The company has revoked the 8 compromised CAs with reason code cessationOfOperation, rather than keyCompromise, indicating no cryptographic weakness was exploited. The Python script used was limited to this incident; normally, keys are generated in place without transfer. The incident resulted from reading private keys into memory during transport rather than a cryptographic attack.
Remediação
eMudhra has committed to reviewing and improving their key management and script handling procedures, including publishing their scripts for transparency. Browser vendors like Microsoft, Chrome, Firefox, and Apple have announced timelines to distrust certificates from the affected roots, starting from November 16 and continuing into late November, to phase out the trust for all certificates chained to these compromised CAs (including emSign Root CA - G1). Users are advised to review certificate status and update to new certificates issued by alternative providers.
Linha do tempo
-
eMudhra Revokes 8 Intermediate CAs Following Key Handling Flaws Despite No Key Weakness
ler a análise desta fonte ocultar
eMudhra's recent incident involves the revocation of 8 intermediate CAs after a Python script used during a key ceremony improperly handled private keys, leading to potential security concerns. Although the keys were not weakened cryptographically, the company cannot demonstrate that private key material was managed in compliance with their policies. The incident traces back to a mistake during a key transfer process, where private keys were read into memory, risking exposure. Despite the absence of malicious misuse, browsers and certificate authorities are removing trust from affected certificates.
Technical Details
The incident stems from a flaw in an in-house Python script used during a key ceremony on April 30, 2025. The script read private RSA keys from HSMs into memory and rebuilt them for transport, which, due to a coding error, truncated the private key values for 8 CAs. Although these keys still generated valid signatures, the process did not meet the company's policy requirements for handling private key material, leading to their revocation. The company conducted a detailed incident review after detecting invalid CRL signatures in June 2025.
Fix Details
The company has revoked the 8 compromised CAs with reason code cessationOfOperation, rather than keyCompromise, indicating no cryptographic weakness was exploited. The Python script used was limited to this incident; normally, keys are generated in place without transfer. The incident resulted from reading private keys into memory during transport rather than a cryptographic attack.
Remediation
eMudhra has committed to reviewing and improving their key management and script handling procedures, including publishing their scripts for transparency. Browser vendors like Microsoft, Chrome, Firefox, and Apple have announced timelines to distrust certificates from the affected roots, starting from November 16 and continuing into late November, to phase out the trust for all certificates chained to these compromised CAs (including emSign Root CA - G1). Users are advised to review certificate status and update to new certificates issued by alternative providers.