# eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise

Source: [The Hacker News](https://thehackernews.com/2026/11/emudhra-revokes-8-more-cas-it.html) · 2026-11-11 · Security
Page: https://themorning.dev/story/emudhra-revokes-8-more-cas-it-previously-declared-unaffected-by-key-compromise-b80a24c89312068e
Kind: security · Impact: high

## In brief

- eMudhra revoked 8 more intermediate CA certificates after an investigation found improper private key handling during certificate generation.
- The company says an in-house Python script behind its October key compromise caused the problem, though the 8 newly revoked CAs did not have their keys weakened, per The Hacker News.
- eMudhra's account was posted on Bugzilla, where it blames a buggy script for issuing insecure certificates.

## Why it matters

Certificates signed by revoked intermediate CAs will stop being trusted, so developers and organisations relying on eMudhra-issued certificates may face broken TLS or signing chains.

## What to do

- Check whether your systems rely on certificates issued under the revoked eMudhra intermediate CAs and plan replacement.

## Timeline

- 2026-10-01: Private key compromise tied to in-house Python script at eMudhra (October 2026, exact day not given in sources)
- 2026-11-11: eMudhra revokes 8 more intermediate CA certificates after investigation
- 2026-11-12: eMudhra's incident account posted on Bugzilla and reported by The Register

## Coverage

- [Disgraced former CA eMudhra blames buggy script for hopelessly weak certificates](https://www.theregister.com/security/2026/11/12/disgraced-former-ca-emudhra-blames-buggy-script-for-hopelessly-weak-certificates/5309244) — www.theregister.com - Articles, 2026-11-12
- [eMudhra revokes 8 more CA certificates after private key mishap](https://www.bleepingcomputer.com/news/security/emudhra-revokes-8-more-ca-certificates-after-private-key-mishap/) — BleepingComputer, 2026-11-11
- [eMudhra's official incident report on how they ended up with private key 4](https://www.reddit.com/r/programming/comments/1xtrm8s/emudhras_official_incident_report_on_how_they/) — top scoring links : programming, 2026-11-11
- [eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise](https://thehackernews.com/2026/11/emudhra-revokes-8-more-cas-it.html) — The Hacker News, 2026-11-11
- [How the Python ecosystem responded to the eMudhra intermediate compromise](https://pyfound.blogspot.com/2026/11/how-python-ecosystem-responded-to.html) — Python Software Foundation News, 2026-11-05
- [Java Patching at Incident Speed: Lessons from the eMudhra CA Compromise](https://foojay.io/today/java-patching-at-incident-speed-lessons-from-the-emudhra-ca-compromise/) — foojay.io - Friends Of OpenJDK, 2026-11-05

Tags: certificates, private-key, eMudhra, certificate-authority, incident-response

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev