eMudhra cancels 8 additional intermediate CA certificates.
Certificate authority eMudhra has revoked eight more intermediate CA certificates after finding that its 2025 key transfer script improperly handled RSA private keys outside of HSM protection. The action brings the total number of affected middleware to 16, after eight previous ECDSA keys were found to be truncated to a single byte in an incident report. Several deprecated RSA brokers issued TLS certificates and code signing as recently as November 3.
The case extends from a weak key compromise to a broader PKI process failure: eMudhra failed to demonstrate that the RSA keys remained compliant with its handling requirements. Pre-existing browser and operating system mistrust operations remain operationally significant, as the integrity of the chain of trust, not just key strength, is affected.
Open sources - closed narratives.