An update to my earlier posts on eMudhra’s CA key compromise and the distrust advisories that followed (linked below). eMudhra has now revoked 8 more intermediate CAs, ones it had earlier said weren’t affected, The Hacker News reports.
- What happened: The October problem came from an in-house Python script used at an April 30, 2025 key ceremony to move keys between Utimaco and Crypto4A HSMs. A single line in it cut 8 ECDSA private keys down to their leading byte. The weak copies carried labels almost identical to the originals, so they got used for signing.
- What’s new: The same script also pulled the RSA keys of 8 other CAs out of the HSMs. eMudhra says it can’t prove those keys were handled the way its own rules require, so it revoked them late last week. On Oct. 19 it had written that the RSA issuers “are therefore not impacted.”
- What’s affected: Six of the CAs were for TLS and two were for code signing. Four had been in production since May, and they issued 195 listed certificates, 29 of them for eMudhra’s own domains.
SecurityWeek also notes that Cisco and SonicWall said Tuesday they’ve removed the affected eMudhra root certificates from their products.
My take
“Unaffected” lasted about three weeks. If you run anything that trusts eMudhra, especially for code signing, re-check your trust stores and pick up the vendor updates.
God Bless, and May the Source Be with You!
References & Further Reading
- eMudhra revokes 8 more CAs it previously declared unaffected by key compromise (The Hacker News)
- Asus, Zoom release security patches; Cisco and SonicWall remove eMudhra roots (SecurityWeek)
- Update: Cisco’s eMudhra distrust advisory (EtherNinja)
- eMudhra’s CA private keys were compromised (EtherNinja)
