eMudhra Revokes 8 More Certificate Authorities Following Major SSL Private Key Security Failure

eMudhra has revoked eight additional intermediate certificate authorities (CAs) after conducting a thorough review of the key issue that led to its October security failure.

The new group did not have weak keys, but eMudhra could not prove the keys were handled the way its own rules require. The company has now pulled 16 intermediate certificates.

The problem goes back to a key issue on 30 April 2025. According to reports, the keys were first created correctly inside a hardware security module, or HSM.

eMudhra Certificate Authority Revocation

A custom Python script then processed them to prepare a move to another device. A bug in that script shrank eight keys into tiny numbers such as 4, 56, 66, 115, 155, 156, 230 and 237.

Mozilla’s public bug record explains why this was so bad. A P-384 private key should be a huge random number. Mozilla’s lead reporter found that all eight keys were smaller than 256, so anyone could rebuild them by simply guessing the first 256 keys.

The same report says the script also made copies of eight other keys in an ordinary computer’s memory. Those keys stayed strong, but eMudhra said it could not show they were handled as its policy demands.

So it revoked all 16 certificates tied to the affected keys. Mozilla’s bug thread lists the new batch, including intermediates named EM DV TLS CA – G2B and G2C, which sit under emSign Root TLS CA – G1.

eMudhra added that this was the first time it moved keys between HSMs in different regions. It now creates keys without such transfers.

According to the disclosure site by a researcher named Wayne, the weak keys were discovered on 17 October. He proved control by signing a short message with each key and sent it to the Mozilla, Chrome, Apple, and Microsoft root teams.

Mozilla then rebuilt the keys on its own within hours, which proved the flaw was real and easy to use. Chrome and Firefox blocked the certificates that same day. Microsoft blocked them on 20 October, and Apple followed on 22 October, according to the disclosure site run by Dennis Jackson.

eMudhra revoked the first eight on 18 October. Our earlier report on the eMudhra certificate authority compromise covers those first emergency steps.

On 22 October, eMudhra said it would leave the global SSL/TLS certificate business. The company said no data was breached and that the affected intermediates had issued no website certificates.

Read more in our story on eMudhra exiting the SSL/TLS market. The company later cut its FY27 revenue outlook to about Rs 800 crore from Rs 825 crore and hired KPMG as an outside reviewer.

Mozilla and Chrome also moved to remove trust in emSign ECC Root CA – G3. This protects tools that ignore revocation lists. eMudhra estimated about 30,000 certificates needed to move, and about 97 percent of them came through ACME, the automatic renewal system.

Apple fixed its developer tools issue on 10 November. Command-line tools such as curl and git on macOS now reject the bad certificates in macOS 27.2.1, 26.7.3 and 15.8.3. Those updates also remove several eMudhra roots from the system file.

Microsoft has gone further. Its 10 November update says it will remove the remaining eMudhra roots from Windows, Edge and WebView2 starting 16 November.

Earlier, Microsoft had pushed an emergency Windows update, which we covered in Microsoft’s emergency update for eMudhra certificates. Oracle also shipped a Java fix for the same trust problem.

Browsers that enforce Certificate Transparency would likely have caught a fake certificate. The disclosure site notes that many other tools do not.

These include curl, language runtimes, Electron apps such as Slack and Discord, and anything that ships its own certificate bundle. The site also says it is unknown whether anyone used the weak keys against these clients.

Update browsers, operating systems, and runtimes. Check any app, container, or build server that keeps its own trust list. On Macs, run the git and curl checks from the disclosure site after updating.

Admins should also watch for the 16 November Microsoft change if they still rely on eMudhra chains. The lesson is simple. Strong math doesn’t help if a small script bug weakens the keys, and a CA must test its keys before using them.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post eMudhra Revokes 8 More Certificate Authorities Following Major SSL Private Key Security Failure appeared first on Cyber Security News.