eMudhra revoked eight intermediate certificate authorities that it previously declared safe from an October key compromise.
The reversal follows a full incident report published on Mozilla’s bug tracker by the Indian cybersecurity firm, The Hacker News reported. The discovery stems from a custom Python script used during a key generation ceremony on April 30, 2025.
As Business Today noted, the organization handled them via a tailored Python script before moving them to an alternate hardware unit, with the firm saying that the keys were properly produced on a hardware security module during a 30 April 2025 ceremony.
After the round trip, the script read each private key out of the hardware security module into the ceremony computer’s memory and rebuilt the key from that copy. During that read-back process, a single code line shortened the private value of the eight ECDSA keys down to just their first byte.
The reconstructed key retained a tag nearly indistinguishable from the authentic one, enabling the vulnerable duplicate to proceed toward signing and certification. The resulting keys were exceptionally small, with numbers such as 4, 56, 66, 115, 155, 156, 230 and 237.
The script also processed keys through the read-back procedure, copying private values into the memory of an ordinary computer, making the keys potentially exposed outside the secure hardware environment.
Of the eight, six were for website TLS certificates and two for code signing, while the company had put four of them into production in May.
The newest was issued last week just days before the revocation of the CAs, while the inventory counts 195 certificates derived from them—comprising 130 originating from EM DV TLS CA – G2C, 63 from EM OV TLS CA – G2C, and 2 from the code-signing CA, EM OV CS CA – G2C—with twenty-nine pointing to its own domains alongside other entries designating various colleges and universities, a county, and additional entities.
“The RSA issuers went through a different path as per our assessment of the code and are therefore not impacted,” the company wrote on Mozilla’s bug tracker on October 19.
Subsequent reviews revealed that the company revoked all sixteen certificates connected to these affected keys as it could not guarantee that they met its own security policy, and since then, the company has generated keys without having to transfer them.
Mentioned in an early-week support note, Apple said that macOS 27.2.1, 26.7.3 and 15.8.3 prevent integrated command-line utilities like curl and git from acknowledging the faulty TLS CA certificates, while removing five root certificates—emSign Root CA – G1 included—from /etc/ssl/cert.pem.
