eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise

eMudhra revoked 8 additional intermediate certificate authorities (CAs) due to a flawed internal Python script used during a key ceremony on April 30, 2025. The script improperly handled private keys by extracting them from hardware security modules (HSMs) into memory and, in the case of ECDSA keys, truncating them to a single byte, resulting in weakened cryptographic strength. Although the RSA keys were not truncated, their private components were exposed in memory, violating internal control policies and preventing eMudhra from proving compliance with its own certificate practice statement. The company had previously declared these CAs unaffected but reversed course after further review, ultimately revoking them due to inability to demonstrate proper key handling, with no known exploitation reported.

AI-extracted · verify before operational use