eMudhra Revokes Eight RSA Intermediate Certificates

Daily CyberSecurity reports that Indian certificate authority eMudhra has extended its certificate revocation to include eight additional RSA intermediate certificates. The piece attributes the remediation to the same flawed generation workflow that exposed ECDSA keys, with administrators invalidating the entire batch and the vendor departing from the public TLS certificate market.

The report notes that the eight RSA-4096 keys were affected, contrasting them with the eight accompanying ECDSA keys, and states that the revocation followed cessation of operation guidelines rather than explicit key compromise, according to the Mozilla Bugzilla incident analysis for eMudhra (Bug 2083449, section c11).

Forensic findings traced the root cause to an April 30, 2025 infrastructure deployment when sixteen intermediate certificate pairs were generated across regional facilities to move keys between hardware security modules. A custom Python migration script corrupted the import process, retaining only the leading byte for ECDSA key objects and exposing private keys, while the RSA-4096 material was loaded directly into unencrypted memory.

The article asserts that these practices violated CA/Browser Forum standards and prompted immediate invalidation. It also describes missed warning signs from May and June 2025, when several ECDSA intermediates failed revocation-list signature checks and were linked to weak scripted keys, with engineers allegedly swapping signing key objects rather than addressing the root cause.

The piece concludes with eMudhra’s permanent exit from the public TLS market, and notes that outdated devices may remain vulnerable until administrators purge the affected roots manually. Do Son signs off as Daily CyberSecurity’s researcher.