eMudhra/emSign CA key compromise — 8 more intermediate CAs revoked after buggy Python key-transfer script
Severity: high · Patch status: no-fix-needed · Since 2026-11-11
eMudhra revoked 8 more intermediate CAs after its in-house Python wrap/unwrap script, used during an April 30, 2025 key ceremony to move keys between Utimaco and Crypto4A HSMs, read private keys into ceremony-computer memory. A single line truncated 8 ECDSA CA private keys to their leading byte (values 4–237), enabling anyone to derive the keys and impersonate websites; the 8 newly revoked RSA keys were not weakened but their private exponents and primes sat in process memory, so the company cannot demonstrate CPS §6.2.6 compliance. 195 certificates (130 DV TLS, 63 OV TLS, 2 code-signing) were reissued. Weak keys passed linting and two WebTrust audits; invalid CRL signatures in June 2025 were an early sign. No misuse known; Certificate Transparency-enforcing browsers were not at risk. eMudhra is exiting publicly trusted TLS; Microsoft removes remaining roots Nov 16, Apple ends G1 trust Nov 30; KPMG review due Dec 4.
What to do
- Replace any certificate chaining to revoked eMudhra/emSign G2C or G1 issuers with certificates from another trusted CA before browser trust removal dates (Nov 16/30)
- Search Certificate Transparency logs for certificates issued by the revoked G2C intermediates and confirm reissuance
- Update macOS/Apple platforms to versions that drop the compromised CA certificates (27.2.1, 26.7.3, 15.8.3)
- Stop relying on emSign G1 certificates for curl/git/command-line tooling; pin alternative trust stores if needed
- Monitor the Mozilla bug tracker and KPMG review outcome for further revocations
Sources
All live incidents on Threat Watch
