eMudhra fiasco widens: eight more CAs revoked, Microsoft pulls trust

Indian digital certificate authority eMudhra has revoked another eight intermediate certificate authorities, and has traced the weak keys behind its October compromise to a single line in a homebrew Python script.

As a consequence, the company's digital credentials will be distrusted by peers.

While Google and Mozilla will let existing, older certificates expire, while eMudhra said Apple would end trust in all of them on November 30. 

Microsoft went further and will from November 16 remove all 10 remaining eMudhra roots from Windows, Edge and Azure.

eMudhra's roots shipped in the trust stores used by Windows, macOS, Firefox, Chrome and major Linux distributions, so Australian systems trusted its intermediates by default.

Apple blocked the compromised certificates in Safari, Mail and apps built on its frameworks in October, but command-line tools such as curl and git kept trusting them until macOS versions 27.2.1, 26.7.3 and 15.8.3 removed the roots from the system certificate file.

One line of code

The fault dates to a key ceremony on April 30 2025, when eMudhra generated 16 subordinate CA keys on Utimaco hardware security modules, planning to move them to Crypto4A modules for its delayed United States facility.

To bridge the two vendors, its public key infrastructure (PKI) operations team wrote its own script and switched off the source module's FIPS-approved mode for the step.

"For the ECDSA objects, a single line in that read-back truncated the private value to its leading byte, so the re-created object held a scalar below 256," eMudhra said in its Bugzilla incident report.

That left keys anyone could recover by trying each possible number below 256. 

The certificates were public for about 18 months and passed two WebTrust audit cycles before a third party reported the flaw on 17 October.

"Nothing in the ceremony tested CA key strength or compared the certified key to the originally generated key," the report said, although eMudhra noted the Baseline Requirements browsers impose on CAs do not require such a check.

In October, eMudhra said they were safe.

“The RSA issuers went through a different path as per our assessment of the code and are therefore not impacted,” an engineer with the company said.

It has since withdrawn that assurance, after finding that the keys’ secret parts sat in the ordinary memory of the ceremony computer while being moved, outside the protection of the hardware modules.

eMudhra is leaving the public TLS business, with all issuance from its older G1 hierarchy due to stop by 10:59am AEDT on 17 November.