"During a single key‑generation ceremony on 30 April 2025, sixteen subordinate (issuing) CA key pairs in eMudhra’s ‘B’ and ‘C’ series were generated correctly on a hardware security module and then processed through an approved wrap/unwrap round‑trip using a custom python key‑handling script," wrote a Bugzilla user identified as "Naveen Kumar ML."
Naveen Kumar ML's account of the April 30, 2025 ceremony
According to the Bugzilla post, eMudhra generated sixteen subordinate (issuing) CA key pairs on 30 April 2025 using HSMs. The process produced eight ECDSA P‑384 private keys that should have been 48 bytes each. Kumar says the keys were generated correctly on the hardware security modules and were then handled by a "custom python key‑handling script" during an approved wrap/unwrap round‑trip.
The buggy Python script and truncated ECDSA P‑384 keys
Kumar attributes the security failure not to the emCA software but to "a bug/defect in the import code [which] resulted in a read‑back from the unwrapped object that truncated the private value, so the certified public keys correspond to private scalars below the expected range and are recoverable from public information." The post asserts that the truncation effectively ignored 47 of the 48 bytes, producing extremely weak single‑byte private keys — the report cites examples including "the number four." In short: correctly generated keys on the HSM were corrupted by a post‑generation script that truncated the private scalar before certification.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogWhy eMudhra used Utimaco and Crypto4A HSMs
Kumar explained the unusual cross‑vendor key handling arose from "global supply chain constraints" that prevented eMudhra from acquiring the HSMs it preferred for the certificates intended for use in the USA. The company therefore generated keys on Utimaco HSMs and planned to transfer them to Crypto4A HSMs. That transfer required the custom wrap/unwrap handling that relied on the Python script — and it was that script, Kumar says, that contained the import bug.
Consequences: browser vendors, Mozilla, and eMudhra's exit from TLS/SSL issuance
A Mozilla team member noticed the weak keys and pointed out that attackers could exploit them to issue fraudulent certificates capable of impersonating servers, observing traffic, or modifying data in transit. In response, browser‑makers "quickly tweaked their software so it would not recognize certs from eMudhra." The fallout was immediate: eMudhra announced it would quit the SSL/TLS certification business, saying the unit had "never a major source of revenue but had suddenly become a severe source of embarrassment."
How technologists, procurement leaders, and end users are affected
- Technologists and security teams: The incident highlights that keys correctly generated by an HSM can be rendered insecure by downstream key‑handling code; Kumar emphasizes the vulnerability occurs when a custom script truncates private values so that "the certified public keys correspond to private scalars below the expected range and are recoverable from public information."
- Procurement and operations leaders: The chain-of‑custody decision to use Utimaco HSMs and then transfer keys into Crypto4A units — driven, Kumar says, by "global supply chain constraints" and policy changes requiring new certificates by the end of May — demonstrates how supply and policy pressures can create atypical, risky operational workflows.
- End users and relying parties: Because browser‑makers modified recognition of eMudhra certificates, those certificates are no longer trusted by major browsers — a direct mitigation that prevented continued use of the compromised certificates but also terminated eMudhra's role as an SSL/TLS issuer.
eMudhra's stated remediation and the unresolved questions
Kumar's post lists three steps eMudhra will take to wind down its certification business. One step is quoted verbatim: "Put in place improvements motivated by findings of [an] independent review to strengthen our general PKI operations." That pledge ties the company's next actions to an independent review, but the post does not spell out the other two steps or the timeline for implementing the promised improvements.
The facts as reported are stark and specific: correctly generated keys were corrupted by a custom script on an isolated ceremony host, truncated down to trivially small private values, and subsequently certified; a Mozilla team member flagged the weakness; browser‑makers revoked recognition; and eMudhra exited the SSL/TLS CA business while promising independent‑review‑driven fixes. The immediate remediation — browsers refusing to recognize affected certificates — closed the door on continued use, while eMudhra's pledge points toward a formal post‑mortem, the scope and findings of which remain to be published.
