Crypto4A

eMudhra Revokes Eight More Intermediate CAs After Python Script Exposes RSA Keys During HSM Transfer

eMudhra has revoked eight additional intermediate certificate authorities after discovering that a custom Python script exposed their RSA private keys in memory during a key ceremony. The company previously declared these CAs unaffected by the October key compromise incident. The script retrieved keys from Utimaco HSMs for transfer to Crypto4A devices but failed to demonstrate compliance with the company's CPS rules on key handling. Six of the revoked CAs were used for TLS certificates and two for code signing, affecting 195 certificates including those for universities and government entities. The incident originated from an April 2025 key ceremony where the same flawed script was used. Browsers including Microsoft, Apple, Chrome, and Firefox are accelerating the removal of trust in eMudhra's remaining roots as the company exits the public TLS market.