thehackernews.com
Nov 11, 2026
eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise
AI-summarised brief · reviewed before publication
eMudhra’s October key compromise script also affected eight additional intermediate certificate authorities (CAs) by truncating their RSA private keys to a single byte during a key ceremony on April 30, 2025. The compromised keys were rebuilt from memory and used to sign certificates, producing valid signatures that passed audits. The company revoked the eight CAs late last week, citing inability to prove compliance with its key‑handling policy. The revocations affect 195 certificates, including 29 for eMudhra’s own domains.
💡 Why It Matters
- · The incident exposes a critical flaw in eMudhra’s key‑management process, undermining trust in its PKI infrastructure and potentially compromising the security of websites and software that rely on its certificates.
