eMudhra Revokes 8 More CAs After October Key Compromise
Indian certificate authority eMudhra revoked eight more intermediate CAs it had earlier called unaffected by its October key incident, because it cannot show their keys were handled safely.
⚡ Why it matters
Certificates underpin trust in HTTPS and code signing, and a weak CA key could in theory impersonate any site. Anyone using eMudhra G1 certificates needs to replace them.
Background
At a key ceremony on April 30, 2025, eMudhra generated 16 CA keys on Utimaco HSMs, meant to move to Crypto4A HSMs at its US and EU sites. Because cross-vendor key transfer is limited, its team wrote a Python script to wrap and unwrap the keys.
According to the incident report, the script copied every private key from the HSM into the ceremony PC's memory and reconstructed it there. For eight ECDSA keys, one line truncated the private value to its first byte. The certificates still passed linting and two WebTrust audits unnoticed. Those were the eight keys exposed in October.
What's new
The eight newly revoked CAs use RSA keys that were not weakened, but the same script pulled them out of the HSMs and the company cannot prove they were handled per its rules. It revoked them last week, after saying on October 19 that they were unaffected.
- Six issued TLS certificates and two issued code signing certificates.
- 195 certificates came from them, 29 for eMudhra's own domains.
- The company knows of no misuse.
What's next
Under eMudhra's phase-out plan, G1 certificates issued after November 16 lose trust in Chrome and Firefox, while Apple will distrust all G1 certificates, including older ones, on November 30.
What to do
Check your site and code signing certificates. If they come from eMudhra G1, replace them with another CA before November 30.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Operation TorNado: 354 Dark Web Vendors and Buyers Arrested
Europol and the US Justice Department announced 354 arrests of vendors and buyers on dark web markets including Archetyp, Nemesis, Tor2Door, Bohemia and Kingdom, in a 14-country operation called TorNado.
German Law Gives Spy Agencies Hacking and Sabotage Powers
Germany's Bundestag passed a law on Friday letting intelligence agencies hack foreign systems, disrupt adversaries' supply chains and knock offline servers operated by hostile state hacking groups.
ArcticRAT Android Malware Uses AI to Profile Victims
Zimperium reports that ArcticRAT has evolved from an Android crypto stealer into a remote access Trojan (RAT) that takes over devices and uses an AI model to sift stolen messages for financial information.