eMudhra Revokes 8 More CAs After Weak Private Key Script Error
eMudhra has revoked eight additional intermediate certificate authorities due to a security failure involving a Python script that generated weak private keys, bringing the total revoked to 16.
eMudhra has revoked eight additional intermediate certificate authorities (CAs) following a comprehensive review of the security lapse that led to its October incident. While these newly revoked CAs did not themselves have weak keys, eMudhra could not definitively prove that their keys were handled in strict accordance with its own security policies. This action brings the total number of revoked intermediate certificates to 16.
The root cause of the issue traces back to April 30, 2025, when a custom Python script was used to process private keys that had been initially generated within a hardware security module (HSM). A flaw in this script inadvertently reduced the complexity of eight private keys, generating exceptionally small numbers such as 4, 56, 66, 115, 155, 156, 230, and 237. This was particularly critical because a P-384 private key should be a vast, randomly generated number; the discovered keys were all smaller than 256, making them trivial to guess and reconstruct.
Compounding the issue, the same script also created copies of eight other keys in the memory of an ordinary computer. Although these keys remained strong, eMudhra stated it could not provide sufficient evidence that they were handled according to its stringent policies. Consequently, all 16 certificates associated with these compromised or questionably handled keys were revoked.
Researchers discovered the weak keys on October 17, 2026. Proof of compromise was demonstrated by signing a short message with each affected key and submitting it to major root program operators, including Mozilla, Chrome, Apple, and Microsoft. Mozilla was able to rebuild the keys within hours, confirming the severity and exploitability of the flaw. Browsers like Chrome and Firefox blocked the associated certificates on the same day, with Microsoft and Apple following suit shortly after.
eMudhra initially revoked eight certificates on October 18, 2026, and subsequently announced its decision to exit the global SSL/TLS certificate business on October 22, 2026. The company maintained that no data breaches occurred and that the affected intermediate certificates had not issued any website certificates. This decision led to a revised FY27 revenue outlook and the engagement of KPMG for an external review.
Beyond the immediate revocations, trust in the emSign ECC Root CA – G3 was also impacted, affecting tools that bypass standard revocation lists. eMudhra estimated that approximately 30,000 certificates needed migration, with the majority handled via the ACME automatic renewal system. Major operating system vendors and browsers have since taken steps to distrust eMudhra certificates, with Microsoft planning to remove remaining eMudhra roots from Windows and Edge starting November 16, 2026.
The incident underscores a critical lesson: even robust cryptographic math is rendered useless by simple script errors that weaken private keys. It highlights the imperative for Certificate Authorities to rigorously test and validate key handling processes before deployment, especially when moving keys between different security modules or regions.