eMudhra fiasco widens: eight more CAs revoked, Microsoft pulls trust

ملخص مفصل

Certificates were public for about 18 months before discovery.

Indian digital certificate authority eMudhra has revoked another eight intermediate certificate authorities, and has traced the weak keys behind its October compromise to a single line in a homebrew Python script.

As a consequence, the company's digital credentials will be distrusted by peers.

While Google and Mozilla will let existing, older certificates expire, while eMudhra said Apple would end trust in all of them on November 30.

Microsoft went further and will from November 16 remove all 10 remaining eMudhra roots from Windows, Edge and Azure.

eMudhra's roots shipped in the trust stores used by Windows, macOS, Firefox, Chrome and major Linux distributions, so Australian systems trusted its intermediates by default.

Apple blocked the compromised certificates in Safari, Mail and apps built on its frameworks in October, but command-line tools such as curl and git kept trusting them until macOS versions 27.2.1, 26.7.3 and 15.8.3 removed the roots from the system certificate file.

The fault dates to a key ceremony on April 30 2025, when eMudhra generated 16 subordinate CA keys on Utimaco hardware security modules, planning to move them to Crypto4A modules for its delayed United States facility.

To bridge the two vendors, its public key infrastructure (PKI) operations team wrote its own script and switched off the source module's FIPS-approved mode for the step.

"For the ECDSA objects, a single line in that read-back truncated the private value to its leading byte, so the re-created object held a scalar below 256," eMudhra said in its Bugzilla incident report.

مطلع المقال، مقتطف من iTnews. لقراءة المقال كاملًا، افتحه على موقع الناشر.