eMudhra has revoked eight more intermediate certificate authorities (CAs), taking the total in its certificate crisis to 16, after the Indian firm could not show their private keys were handled in line with its own rules. The revocations are a second blow from the same key ceremony that produced the first eight weak keys.

What the eight new revocations cover

The eight additional CAs are RSA-4096 intermediates: six that issued TLS certificates and two that issued code-signing certificates. Their keys were not found to be cryptographically weak. Instead, eMudhra could not demonstrate that sensitive private-key components were handled safely after passing through the memory of a ceremony computer. It recorded the reason as cessationOfOperation, not keyCompromise, so it has not established that the keys were stolen or cracked. The eight CAs had issued 195 end-entity certificates, now replaced, as reported by The Cyber Throne.

One ceremony, two failures

Both sets of keys came from one ceremony on 30 April 2025, when keys were generated inside Utimaco hardware security modules and migrated to Crypto4A modules using a custom Python script, as reported by The CyberSec Guru. A fault in the script’s read-back process truncated eight ECDSA private keys to a single byte — one was the number 4 — so they could be recovered from the public certificates. Those eight were revoked on 18 October 2026, and on 22 October eMudhra’s board decided to leave the global SSL/TLS certificate business. Google, Mozilla, Microsoft and Apple have all moved to distrust the affected certificates.

What to do now

Website owners should check whether any of their certificates chain to eMudhra intermediates and replace them if so. Certified hardware alone is not enough: the procedures around key generation, transfer and validation matter just as much.