eMudhra blames Python key-handling bug for weak certificate keys

Former certification authority eMudhra says a defect in a custom Python script caused it to issue digital certificates backed by dangerously weak private keys. The company’s explanation, posted to Bugzilla by a user identifying as “Naveen Kumar ML,” describes a key-generation process that failed to preserve the full private values. The company says the script was used during a single ceremony on April 30, 2025.

The affected certificates were associated with sixteen subordinate, or issuing, certificate authority key pairs in eMudhra’s “B” and “C” series. According to the account, the key pairs were initially generated on a hardware security module (HSM), then subjected to a wrap-and-unwrap process using the custom script. The error occurred when the script read back an unwrapped key object, truncating the private value.

Key transfer process introduced a failure point

eMudhra said it intended to generate eight ECDSA P-384 private keys. A key of that type should have a 48-byte private value. The reported truncation meant the public keys in the resulting certificates corresponded to private scalars far below the expected range. Because of that weakness, the private values could be recovered using information available from the public keys.

The company’s account describes the script as a workaround for hardware procurement problems, rather than part of its emCA software. eMudhra said global supply-chain constraints prevented it from obtaining the HSMs it wanted for generating certificates intended for use in the United States. It used HSMs from Utimaco to create the keys and planned to transfer them to devices from Crypto4A.

That cross-vendor transfer required the wrapping and unwrapping process. eMudhra said it pursued the plan because changes to certificate provenance policy required it to generate new certificates by the end of May. Its explanation says the script’s defect went unnoticed and that the company did not test the keys it produced. Those failures left the certificate process without a check that would have detected the truncated private values.

Weak CA keys undermine trust in issued certificates

Certificate authorities are trusted to bind public keys to identities, including the domains used by websites. A certificate signed under a compromised or predictable issuing key can therefore create risks beyond the organization that generated it. A malicious party able to use such a key could produce fraudulent certificates that appear to establish trust in an impersonated server. That could enable interception or alteration of communications, depending on the circumstances and the affected systems’ trust decisions.

A Mozilla team member identified the weakness, prompting browser makers to change their software so it would no longer recognize eMudhra certificates. The company subsequently exited the SSL/TLS certificate business. It has said that line of business was not a major revenue source, but the incident became a significant reputational problem.

The explanation places responsibility on a bespoke script and the operational decision to move keys between HSM vendors. It does not make the resulting certificates safe: the central issue is that the private key material was not validated after processing, and the certificates had already been issued with keys that could be recovered from public information.

What PKI teams should take from the incident

For enterprise PKI and identity teams, the case highlights the importance of treating key import, export, wrapping and unwrapping as security-critical operations. HSM-backed generation does not by itself guarantee that a key remains correct through subsequent handling. Verification needs to cover the key material and its relationship to the public key and certificate, rather than relying only on the fact that a key originated in an HSM.

• Validate key properties after each transfer or transformation, including expected algorithm and key length.
• Test custom key-handling code with independent checks before using it in a certificate-issuing workflow.
• Maintain controls that can stop issuance when key material fails validation.
• Review certificate trust and revocation decisions when an issuing key is found to be recoverable.

eMudhra said it plans to wind down its certification business and implement improvements motivated by an independent review to strengthen its broader public key infrastructure operations. The company’s account provides a technical explanation for the weak keys, while also underscoring how a rushed hardware workaround and inadequate validation can defeat the protections expected from a certificate authority.