Wayne

eMudhra Revokes Eight More Intermediate CA Certificates After Private Key Handling Failure

Certificate authority eMudhra has revoked eight additional intermediate CA certificates following an investigation that uncovered improper private key handling during the certificate generation process. The new revocations bring the total to 16 affected certificates, including eight ECDSA keys that were reduced to a single byte by a faulty custom Python script. The same script also processed eight RSA keys outside the protection of hardware security modules, violating the company's certificate policy. Earlier warning signs in June 2025 were not fully investigated, allowing the issue to persist until discovery by researcher Wayne in October 2026. Major browsers and Microsoft released blocking updates, and eMudhra announced it will exit the publicly trusted TLS business. An independent KPMG review is scheduled to deliver findings by December 4.