Summary
- Eight further eMudhra intermediate certificates were revoked, bringing the affected total to 16.
- The latest withdrawals followed findings involving private key handling procedures.
- The new certificates were revoked for cessation of operations, distinguishing them from the initially compromised keys.
Certificate authority eMudhra has withdrawn eight additional intermediate certificates after discovering further deficiencies in its cryptographic key handling procedures.
The latest action involves eight additional intermediate certificate authorities that were withdrawn from service on 7 November, following the earlier revocation of eight certificates whose private keys were found to be recoverable by unauthorised parties.
eMudhra has documented the investigation through Mozilla’s public certificate authority incident process, where browser and platform security representatives are examining the circumstances of the key generation and handling failures.
The combined incident now involves 16 intermediate certificates, although the two groups must be distinguished. The initial eight certificates were revoked following evidence that their private keys could be recovered. The additional eight were withdrawn as part of the broader investigation and migration process, with revocation records identifying cessation of operations rather than the same confirmed compromise condition.
Key handling failures undermine certificate assurance
Intermediate certificate authorities form part of the public key infrastructure used to establish trust in digital certificates. Root authorities delegate signing responsibilities to intermediate authorities, which in turn may issue certificates used by websites, applications and other digital services.
That structure depends on protecting the private keys associated with certificate authorities. If an unauthorised party obtains an intermediate authority’s signing key, it may be possible to create certificates that appear valid within affected trust relationships until appropriate restrictions or revocations take effect.
The original eMudhra incident involved weaknesses in private key generation or handling that allowed researchers to recover key material. Mozilla independently confirmed the issue and moved to restrict trust in the affected certificates.
The expanded investigation identified concerns involving a custom script used in April 2025 during the transfer of private key material between hardware security modules. Such modules are designed to protect cryptographic keys within controlled hardware environments and reduce the possibility of extraction or unauthorised use.
Key transfers require careful procedural controls because the security of the resulting certificate authority depends not only on the mathematical strength of the keys but also on where they were generated, how they were handled and whether adequate evidence exists that unauthorised copies were not created.
Revocation creates a broader operational challenge
Removing an intermediate certificate authority can affect customers whose certificates depend on that authority’s chain of trust. Providers must therefore coordinate revocation, replacement issuance, subscriber migration and the continued distribution of appropriate revocation information.
The operational consequences vary depending on the certificate’s purpose and the way affected applications validate trust. Some systems rely on browser-managed trust stores, while others use operating-system or application-specific certificate stores that may update through different mechanisms.
The distinction is especially relevant for enterprise applications and embedded systems that do not follow the same update schedule as mainstream browsers. A certificate no longer trusted by one platform may continue to be treated differently elsewhere until the relevant security changes are applied.
The latest revocations concern eight RSA intermediate certificates whose private key material was handled through a host-side process associated with a custom Python script. Unlike the eight ECDSA certificates revoked in October, these RSA keys have not been shown to be trivially recoverable. However, eMudhra could not demonstrate that the handling process complied with its required controls, prompting the certificates’ withdrawal for cessation of operations.
eMudhra’s incident response also involves continued work to migrate subscribers and review its internal controls. Public records identify additional actions concerning key inventories, operational procedures and independent examination of the weaknesses that contributed to the incident. The company has also indicated its intention to exit public TLS certificate issuance.
Previous changes arising from the initial compromise included emergency responses from major software providers. The latest certificate withdrawals extend that process rather than representing an entirely unrelated vulnerability or a newly confirmed compromise of every affected private key.
The investigation illustrates how certificate authority incidents can create consequences far beyond the systems operated directly by the provider. Trust relationships established by intermediate certificates may be used by numerous downstream customers, making the quality of cryptographic controls and the speed of coordinated remediation central to maintaining reliable authentication.
Mozilla’s public incident record remains open, with further remediation actions and independent review work outstanding. The final assessment will depend on whether the provider can demonstrate that the identified key handling weaknesses have been corrected and that remaining certificate relationships are managed appropriately.
