eMudhra revokes eight additional RSA intermediate certificates due to flawed private key handling and exits public TLS market
eMudhra, an Indian certificate authority, expanded its certificate revocation to include eight RSA-4096 intermediate certificates following a cryptographic scandal first exposed in October 2025 involving ECDSA keys. The root cause was a flawed custom Python migration script used during a key transfer on April 30, 2025, that corrupted ECDSA key import and directly exposed RSA private keys in unencrypted Python memory, violating CA/Browser Forum standards on private key protection. Although the RSA keys were not compromised bitwise, the improper handling was severe enough to require revocation under cessation of operation guidelines. Early warning signs appeared in May and June 2025 with failures in certificate revocation list (CRL) validations, but superficial fixes delayed proper remediation. Following reputational damage and low profits, eMudhra announced its permanent exit from the public TLS certificate issuance market. Legacy and unpatched systems remain potentially vulnerable to man-in-the-middle attacks until manual root purges are performed.
Linha do tempo
-
eMudhra revokes eight additional RSA intermediate certificates due to flawed private key handling and exits public TLS market
ler a análise desta fonte ocultar
eMudhra, an Indian certificate authority, expanded its certificate revocation to include eight RSA-4096 intermediate certificates following a cryptographic scandal first exposed in October 2025 involving ECDSA keys. The root cause was a flawed custom Python migration script used during a key transfer on April 30, 2025, that corrupted ECDSA key import and directly exposed RSA private keys in unencrypted Python memory, violating CA/Browser Forum standards on private key protection. Although the RSA keys were not compromised bitwise, the improper handling was severe enough to require revocation under cessation of operation guidelines. Early warning signs appeared in May and June 2025 with failures in certificate revocation list (CRL) validations, but superficial fixes delayed proper remediation. Following reputational damage and low profits, eMudhra announced its permanent exit from the public TLS certificate issuance market. Legacy and unpatched systems remain potentially vulnerable to man-in-the-middle attacks until manual root purges are performed.