International
The Morning Dev

Only the news worth knowing

‹
 
B43/100

Breach · high

eMudhra intermediate CA private key compromise and certificate revocations

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Customers and relying parties of eMudhra-issued intermediate CA certificates

Tier B because: Full takeover OR secrets exposed OR supply chain

Reach

Attack

Damage

Fix

Secrets exposed

What to do

  1. Check whether your systems rely on certificates issued under the revoked eMudhra intermediate CAs and plan replacement.

The Brief

  • eMudhra revoked 8 more intermediate CA certificates after an investigation found improper private key handling during certificate generation.
  • The company says an in-house Python script behind its October key compromise caused the problem, though the 8 newly revoked CAs did not have their keys weakened, per The Hacker News.
  • eMudhra's account was posted on Bugzilla, where it blames a buggy script for issuing insecure certificates.

Why it matters

Certificates signed by revoked intermediate CAs will stop being trusted, so developers and organisations relying on eMudhra-issued certificates may face broken TLS or signing chains.

The checklist behind the tier

Checklist · 2 of 10 yes
YesHits tech teamsJudgment: CA certificates underpin TLS and code signing that developers and IT teams rely on.
NoCore infrastructureJudgment: one niche CA vendor's key handling is not shared core infrastructure like OpenSSH or GitHub.
NoPopular toolJudgment: eMudhra is a niche regional certificate authority, not a widely used developer tool.
NoExploited in the wildSources describe key mishandling and revocations; none report observed attacks using the flaw.
NoPublic exploitNo source says exploit code or a proof-of-concept was published.
NoRemote, no loginSources describe internal script and key-handling errors; no unauthenticated network attack is reported.
NoFull takeoverKey compromise is reported, but no source reports code execution, root access or account takeover.
YesSecrets exposedThe Hacker News: eMudhra's intermediate CA private key compromise led to revocation of its intermediate CAs.
NoSupply chainSources describe a buggy internal Python script, not malicious code shipped through a trusted channel.
NoNo fix yetSources report revocations and a post-incident report but do not say a fix is unavailable.

Timeline

  1. Private key compromise tied to in-house Python script at eMudhra (October 2026, exact day not given in sources)

  2. foojay.io - Friends Of OpenJDK

    Java Patching at Incident Speed: Lessons from the eMudhra CA Compromise

  3. Python Software Foundation News

    How the Python ecosystem responded to the eMudhra intermediate compromise

  4. eMudhra revokes 8 more intermediate CA certificates after investigation

  5. The Hacker News

    eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise

  6. top scoring links : programming

    eMudhra's official incident report on how they ended up with private key 4

  7. BleepingComputer

    eMudhra revokes 8 more CA certificates after private key mishap

  8. eMudhra's incident account posted on Bugzilla and reported by The Register

  9. www.theregister.com - Articles

    Disgraced former CA eMudhra blames buggy script for hopelessly weak certificates

  10. www.theregister.com - Articles

    Software Samaritan revamps borked Indian certs to block smart TV ads

Full coverage · 7 sources

First seen · 7 sources · Full story page · How tiers are decided