eMudhra Revokes 8 More CAs, Invalidating 195 Certificates After Key-Transfer Error

eMudhra revoked eight intermediate certificate authorities late last week, ending trust in 195 certificates, including 29 for its own domains. Six CAs issued TLS certificates and two issued code-signing certificates. The company said an in-house Python script used during an April 30, 2025 key ceremony read private RSA keys out of Utimaco hardware security modules into a ceremony computer, leaving key material in process memory. It said it cannot prove the handling met its certificate policy.

The evidence sits in eMudhra's incident report and Mozilla bug tracker: the same script that truncated eight ECDSA keys to one byte also handled eight RSA keys. The RSA keys were not weakened; signatures still verify. The problem is custody. The script exported private exponents and prime factors from HSMs, and logs cannot show how long they remained in memory. That failure of key handling, not cryptographic breakage, triggered revocation under cessationOfOperation rather than CA compromise.

This is a supply-chain incident inside the trust layer. Certificate authorities are not just key factories; they are process controls. eMudhra initially declared the RSA issuers unaffected after code review, then reversed after browser root program discussions. That sequence matters: when a CA says a path is safe and later cannot demonstrate compliance, the failure is not one script line but audit blindness. The weak ECDSA keys passed linting and two WebTrust audits, showing certification ecosystems can miss deterministic key generation errors.

Next, browsers and operating systems will enforce the revocation, breaking affected TLS and code-signing certificates unless sites and developers replace them. The unresolved question is why eMudhra used cessationOfOperation instead of CA compromise, a choice that may affect how other programs assess liability and trust. Root programs should demand independent review of all keys moved between vendors, not just the eight revoked CAs. If the script touched more ceremonies, the blast radius is still unknown.