International
The Morning Dev

Only the news worth knowing

‹
 

Security · High impactFan score 43 · Tier B6 sources

Disgraced former CA eMudhra blames buggy script for hopelessly weak certificates

The Register · By Simon Sharwood ·

Disgraced former CA eMudhra blames buggy script for hopelessly weak certificates

The Brief · written from 6 sources

  • eMudhra revoked 8 more intermediate CA certificates after an investigation found improper private key handling during certificate generation.
  • The company says an in-house Python script behind its October key compromise caused the problem, though the 8 newly revoked CAs did not have their keys weakened, per The Hacker News.
  • eMudhra's account was posted on Bugzilla, where it blames a buggy script for issuing insecure certificates.

Why it matters

Certificates signed by revoked intermediate CAs will stop being trusted, so developers and organisations relying on eMudhra-issued certificates may face broken TLS or signing chains.

Who’s affected

  • Organisations using eMudhra-issued certificates
  • Teams relying on eMudhra intermediate CA chains

What to do

  1. Check whether your systems rely on certificates issued under the revoked eMudhra intermediate CAs and plan replacement.

Former certification authority eMudhra has claimed a buggy Python script is the main reason it issued laughably insecure digital certificates. The company posted its account of the matter on Bugzilla where a user with the handle “Naveen Kumar ML” wrote “During a single…

Read the full story at theregister.com ↗

Timeline

  1. Private key compromise tied to in-house Python script at eMudhra (October 2026, exact day not given in sources)

  2. foojay.io - Friends Of OpenJDK

    Java Patching at Incident Speed: Lessons from the eMudhra CA Compromise

  3. Python Software Foundation News

    How the Python ecosystem responded to the eMudhra intermediate compromise

  4. eMudhra revokes 8 more intermediate CA certificates after investigation

  5. The Hacker News

    eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise

  6. top scoring links : programming

    eMudhra's official incident report on how they ended up with private key 4

  7. BleepingComputer

    eMudhra revokes 8 more CA certificates after private key mishap

  8. eMudhra's incident account posted on Bugzilla and reported by The Register

  9. www.theregister.com - Articles

    Disgraced former CA eMudhra blames buggy script for hopelessly weak certificates

Full coverage · 6 sources

How do you feel about this?

0 Comments