eMudhra has revoked 8 intermediate CAs after an internal security lapse exposed RSA private keys in host memory during a HSM migration.

The incident occurred when a custom Python script, designed to wrap keys between Utimaco and Crypto4A modules, moved key material outside the HSM boundary.

The company cannot verify rule compliance for these keys, prompting the revocation of 6 TLS and 2 code-signing CAs.

An inventory and independent audit are currently in progress.

How did the problem arise?

These systems include 6 for websites and 2 for software verification. The issue began in late April 2025, during testing and transferring keys between different security systems. The operations team used a special program to transfer the digital keys.

During this process, the keys were temporarily moved from the memory of the computer used.…