[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frQO27yZKkUblLXJwOIAKk99GJO7Wd2QxRpLrlcjs7Ac":3},{"article":4,"iocs":47,"watch_terms":58,"solutions":59,"lesson":120},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"f036d345-f989-4e37-ad1f-de28a9cb0d87","eMudhra Revokes 8 More Certificate Authorities Following Major SSL Private Key Security Failure","emudhra-revokes-8-more-certificate-authorities-following-major-ssl-private-key-s-f45fc6","eMudhra has revoked eight additional intermediate certificate authorities (CAs) after conducting a thorough review of the key issue that led to its October security failure. The new group did not have weak keys, but eMudhra could not prove the keys were handled the way its own rules require. The company has now pulled 16 intermediate […] The post eMudhra Revokes 8 More Certificate Authorities Following Major SSL Private Key Security Failure appeared first on Cyber Security News.","eMudhra revoked 8 additional intermediate certificate authorities following a comprehensive audit related to its October 2025 security failure, bringing the total revoked certificates to 16. The original issue stemmed from a buggy Python script that reduced 8 P-384 private keys to tiny numbers (4–237), making them trivially guessable; 8 other keys were improperly handled in unencrypted computer memory, violating the company's own policies. Major browsers (Chrome, Firefox, Microsoft Edge) and Apple have blocked or removed trust in the affected certificates, and eMudhra has exited the SSL\u002FTLS certificate business.","eMudhra revokes 16 intermediate SSL\u002FTLS certificates after discovering weak private keys and unverified key handling","https:\u002F\u002Fcybersecuritynews.com\u002Femudhra-certificate-authority-revocation\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FeMudhra-certificate-authority-revocation.webp","2026-11-11T13:46:31+00:00","2026-11-11T14:00:24.339615+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"eMudhra","vendor",{"name":21,"type":19},"Mozilla",{"name":23,"type":19},"Google",{"name":25,"type":19},"Apple",{"name":27,"type":19},"Microsoft",{"name":29,"type":30},"Hardware Security Module (HSM)","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",[48,52,55],{"type":49,"value":50,"context":51},"malware","EM DV TLS CA – G2B","Revoked intermediate CA under emSign Root TLS CA – G1",{"type":49,"value":53,"context":54},"emSign ECC Root CA – G3","Root CA removed from trust by Mozilla and Chrome",{"type":49,"value":56,"context":57},"emSign Root TLS CA – G1","Parent root CA of affected intermediates",[23,25,27],{"controls":60,"vendors":119},[61,90],{"slug":62,"name":63,"problem":64,"products":65},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":91,"name":92,"problem":93,"products":94},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",[],{"slug":121,"title":122,"body":123,"framework_refs":124,"framework_notes":130},"buggy-script-fatally-weakened-ca-private-keys-destroying-trust-in-emudhra","Buggy Script Fatally Weakened CA Private Keys, Destroying Trust in eMudhra","A defective Python script used by eMudhra reduced P-384 elliptic-curve private keys to trivially small numbers (between 4 and 237), making them computationally trivial to guess and completely undermining the cryptographic guarantees those certificates were meant to provide. Separately, eight other private keys were held unencrypted in memory, violating the company's own documented security policies. This incident illustrates that cryptographic infrastructure is only as strong as the operational processes and code quality controls surrounding it — a single unreviewed script can invalidate an entire certificate hierarchy. The loss of browser and OS trust forced eMudhra to exit the SSL\u002FTLS business entirely, demonstrating how catastrophic key-management failures are for certificate authorities.",[125,126,127,128,129],"NIST SP 800-53 SC-12: Cryptographic Key Establishment and Management","NIST SP 800-53 SA-11: Developer Testing and Evaluation","ISO\u002FIEC 27001:2022 A.8.24: Use of cryptography","NIS2 Article 21(2)(h)","CIS Control 16: Application Software Security (v8)",{"NIS2 Article 21(2)(h)":131,"ISO\u002FIEC 27001:2022 A.8.24: Use of cryptography":132,"CIS Control 16: Application Software Security (v8)":133,"NIST SP 800-53 SA-11: Developer Testing and Evaluation":134,"NIST SP 800-53 SC-12: Cryptographic Key Establishment and Management":135},"NIS2 Article 21(2)(h) specifically mandates appropriate policies and practices on cryptography and encryption, covering exactly the key-generation integrity and secure key-storage requirements that eMudhra failed to meet.","A.8.24 requires an organization to define and follow rules for the effective use of cryptography, including proper key management; storing private keys in unencrypted memory and generating keys with near-zero entropy violated this control.","CIS Control 16 requires secure development practices including code review and security testing; applying it to the Python key-generation script would have detected the mathematical flaw before it was used in production.","SA-11 requires security testing of developer-produced code before use; the buggy Python script that reduced private keys to tiny numbers was never caught because adequate testing and validation of its cryptographic output was absent.","SC-12 requires organizations to establish and manage cryptographic keys according to documented policies; eMudhra's script produced fatally weak keys and other keys were mishandled in unencrypted memory, directly violating this control."]