[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRRrU06y5yhkxd63hIC-m2gA8S_6sABl6GhzPpSi8WME":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"2d0db894-6d27-4f14-a7cb-f8c67e2f909b","buggy-key-migration-script-compromises-16-emudhra-ca-certificates","847d137c-086c-4537-83ec-c549d79010bd","Buggy Key Migration Script Compromises 16 eMudhra CA Certificates","eMudhra's use of a custom Python script to transfer private keys between Hardware Security Modules (HSMs) introduced a critical bug that weakened ECDSA keys and mishandled RSA keys, ultimately undermining the cryptographic integrity of 16 intermediate CA certificates. The root cause was inadequate validation and testing of the key migration tooling before it was used in production on highly sensitive cryptographic material. A missed early warning — CRLs signed with mismatched keys in June 2025 — shows that existing monitoring failed to flag a serious process failure in time. This incident matters because compromised CA private keys can enable the issuance of fraudulent certificates, eroding trust across the entire PKI ecosystem that relies on eMudhra as a trusted authority.","**Immediate actions:**\n- Revoke and replace all certificates whose private keys were generated or handled by the flawed script.\n- Conduct a full audit of all HSM key management procedures and custom tooling currently in use.\n\n**Long-term improvements:**\n- Require peer review, automated testing, and formal security assessment of any script or tool that touches HSM key material before production use.\n- Enforce cryptographic key integrity verification (e.g., test signatures and CRL consistency checks) immediately after any key migration or transfer operation.\n- Establish a formal change management process for PKI operational tooling with mandatory sign-off from a qualified cryptography engineer.\n\n**Detection measures:**\n- Implement automated consistency checks that alert when CRL signing keys do not match the issuing CA certificate, treating mismatches as critical incidents.\n- Deploy continuous compliance monitoring against CA\u002FBrowser Forum Baseline Requirements to catch deviations in key handling workflows before certificates are issued.",[12,13,14,15,16],"NIST SP 800-53 SC-12: Cryptographic Key Establishment and Management","NIST SP 800-53 SA-11: Developer Testing and Evaluation","ISO\u002FIEC 27001:2022 A.8.24: Use of cryptography","NIS2 Article 21(2)(h)","NIST CSF 2.0 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events",{"NIS2 Article 21(2)(h)":18,"ISO\u002FIEC 27001:2022 A.8.24: Use of cryptography":19,"NIST SP 800-53 SA-11: Developer Testing and Evaluation":20,"NIST SP 800-53 SC-12: Cryptographic Key Establishment and Management":21,"NIST CSF 2.0 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events":22},"NIS2 Article 21(2)(h) explicitly covers policies on cryptography and encryption, which the flawed key migration process violated by failing to maintain the integrity of CA private keys.","A.8.24 requires a policy on cryptographic key management and proper use of cryptography; the absence of enforced controls over the key transfer process directly caused the private key mishandling.","SA-11 requires that custom-developed code undergo security testing before deployment; the Python HSM migration script was not adequately tested, allowing a key-weakening bug to reach production.","SC-12 requires organizations to establish and manage cryptographic keys according to documented policies; the buggy migration script violated key management integrity requirements that this control mandates.","Continuous monitoring of PKI operational outputs — such as CRL signing key consistency — would have elevated the June 2025 mismatch to an actionable alert rather than a missed warning sign.","published","2026-11-11T22:20:25.47386+00:00","2026-11-11T22:20:25.443+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Femudhra-revokes-8-more-ca-certificates-after-private-key-mishap\u002F","emudhra-revokes-8-more-ca-certificates-after-private-key-mishap-c13c66","eMudhra revokes 8 more CA certificates after private key mishap",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":50,"name":51,"problem":52},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":54,"name":55,"problem":56},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control."]