Abstract:
Following the revelation in October that the private keys of eight intermediate CA certificates could be easily deduced, the Indian Digital Certificate Authority eMudhra recently announced the revocation of eight more intermediate CA certificates based on the RSA algorithm. These certificates come from the same key generation process as the previously problematic ECDSA certificates, and there were irregularities in the handling of the private keys.
The incorrect script affects both sets of certificate keys:
The investigation revealed that the incident originated from a key generation operation on April 30, 2025, when eMudhra generated 16 sets of intermediate certificates and keys for infrastructure in different regions. The process used a company-written Python script to handle migration between cross-vendor hardware security modules.
The security module initially generated the key correctly, but the company-written script retained only the first byte of the private key when rereading and creating the ECDSA key object. As a result, the values of the eight sets of ECDSA private keys are all less than 256, which can be easily deduced from public information, and these weak keys are also used to generate certificate requests.
An additional 8 sets of RSA4096 keys remain intact, but the private key material also enters the memory of the host Python process on reimport. This mode of operation does not comply with the CA/Browser Forum requirements regarding CA private key transfer, so these certificates also need to be revoked, and eMudhra marks these RSA certificates not as key compromised, but as discontinued.
Anomalies occurred in May 2025 but no attention was paid:
The investigation also showed that eMudhra encountered anomalies from May to June 2025: the certificate revocation lists corresponding to some ECDSA intermediate certificates failed to pass signature verification. Investigation revealed that the cause of the anomaly was that the intermediate certificate used a weak key re-created by a script, while the original revocation list was still signed by the original key.
eMudhra solved the verification problem by changing the key object used for the signature, but did not carefully analyze the specific cause of the error. If an in-depth investigation was conducted at that time, it would be easy to find that the key of the online production certificate was only 1 character4.
eMudhra has decided to exit the TLS certificate business:
After this security incident, eMudhra has decided to no longer operate the TLS certificate business due to the low proportion of revenue from this business and the damage to the company's reputation caused by the security incident. It can be seen that this Caotai company is not concerned about its impact on the global Internet. It just feels that it is better to stop this business without making money and affecting its reputation.
Currently, all major browsers have stopped trusting the eight ECDSA certificates originally revoked by eMudhra. However, the relevant command line tools may not be updated or do not check the certificate revocation settings by default. Some old systems and firmware cannot update certificates. These devices are still affected by eMudhra's weak keys and can be hijacked by middlemen.
Related articles:
eMudhra withdraws from global SSL/TLS certificate business after shocking scandal
Enthusiasts use eMudhra leaked certificates to issue 106,000 certificates for Google, which can pass CA public key certification
Google accuses India's eMudhra of delaying release of accident report. Its employees say social media attention makes it difficult for the company to conduct investigations
Comments