eMudhra revokes 8 more CA intermediates, quits public TLS

Indian certificate authority eMudhra has revoked eight more intermediate CA certificates, all RSA intermediates, on 7 November 2026 — bringing the total pulled in this incident to 16 — and says it will stop issuing under its remaining public hierarchy on 16 November as it exits the publicly trusted TLS business. The disclosure landed in eMudhra's updated incident report filed in Mozilla's root-store Bugzilla; BleepingComputer has the detail. It is the latest turn in a key-handling failure that browser vendors already responded to in October.

What happened

The root cause dates to April 2025, when eMudhra used a custom Python script to move CA private keys between hardware security modules from different vendors because replacement hardware was delayed. A bug in that script reduced eight ECDSA private keys to a single byte of entropy — recoverable by brute-forcing 256 values, which a researcher later did. The same script processed eight RSA keys in host memory rather than inside the HSM. eMudhra says the RSA keys were not mathematically weakened, but it could not demonstrate they met its own policy, stating a re-import from host memory "is not consistent with the CPS §6.2.6." Those are the eight RSA intermediates now revoked.

An early warning was missed: in June 2025, eMudhra found CRLs signed with keys that didn't match their CA certificates, fixed the signing, and did not investigate the cause.

Timeline

• April 2025 — key-transfer script introduces the entropy and host-memory defects.
• 17 October 2026 — researcher "Wayne" discloses the weak keys.
• 26 October 2026 — Microsoft ships out-of-band Windows updates distrusting the chains; Mozilla, Google and Apple push their own blocks.
• 3 November 2026 — last certificate issued from an affected RSA intermediate.
• 7 November 2026 — the eight RSA intermediates revoked.
• 16 November 2026 — planned end of issuance under the G1 hierarchy.
• 4 December 2026 — findings expected from an independent KPMG review.

Action checklist

1. Inventory eMudhra in your chains. Check server certs, client/mTLS certs and any code-signing certs for an eMudhra-rooted path. eMudhra says affected customer certificates have been replaced or migrated, but confirm it yourself rather than trusting the migration ran clean.
2. Apply the vendor distrust updates — the October Microsoft OOB updates and current Chrome, Firefox, Safari builds already block the affected chains. Don't override the warnings for "broken" internal sites that chain to eMudhra; re-issue instead.
3. Pin your renewal to a new CA now. With issuance under the G1 hierarchy ending 16 November, any eMudhra public TLS cert you hold is on a dead-end provider. Plan the migration before expiry forces an outage.
4. Audit trust stores you ship. If you bundle a CA list in an app, container base image or appliance, drop the compromised eMudhra intermediates — runtimes like Node.js already did.

Context

This is the failure mode behind nearly every recent CA incident: not a cryptographic break but a process lapse in how private keys are generated, moved and attested. The entropy-to-a-single-byte bug is spectacular, yet the more damaging detail is the 17-month gap between the April 2025 mistake and the October 2026 external disclosure — plus a June 2025 warning sign eMudhra saw and shelved. The public PKI's answer is the one already playing out: browsers and OS vendors distrust fast, and the CA exits the business. For relying parties the lesson is unchanged — certificate agility (short lifetimes, automated issuance, a tested second CA) is what turns a CA's bad week into a non-event instead of an outage.