eMudhra Revokes 8 More Certificate Authorities Following Major SSL Private Key Security Failure
eMudhra revokes 16 intermediate SSL/TLS certificates after discovering weak private keys and unverified key handling
eMudhra revoked 8 additional intermediate certificate authorities following a comprehensive audit related to its October 2025 security failure, bringing the total revoked certificates to 16. The original issue stemmed from a buggy Python script that reduced 8 P-384 private keys to tiny numbers (4–237), making them trivially guessable; 8 other keys were improperly handled in unencrypted computer memory, violating the company's own policies. Major browsers (Chrome, Firefox, Microsoft Edge) and Apple have blocked or removed trust in the affected certificates, and eMudhra has exited the SSL/TLS certificate business.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA defective Python script used by eMudhra reduced P-384 elliptic-curve private keys to trivially small numbers (between 4 and 237), making them computationally trivial to guess and completely undermining the cryptographic guarantees those certificates were meant to provide. Separately, eight other private keys were held unencrypted in memory, violating the company's own documented security policies. This incident illustrates that cryptographic infrastructure is only as strong as the operational processes and code quality controls surrounding it — a single unreviewed script can invalidate an entire certificate hierarchy. The loss of browser and OS trust forced eMudhra to exit the SSL/TLS business entirely, demonstrating how catastrophic key-management failures are for certificate authorities.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — EM DV TLS CA – G2B
- malware — emSign ECC Root CA – G3
- malware — emSign Root TLS CA – G1