Overview
- The faulty key-transfer script introduced on April 30, 2025 converted eight ECDSA private keys into tiny single-byte values and read eight RSA private objects into host memory, the company said in its November incident report.
- eMudhra has revoked all 16 affected intermediate CAs, stopped public TLS issuance under its G1 hierarchy and said it will exit the publicly trusted TLS business while migrating remaining customers.
- Major browser and operating-system vendors have issued mitigations and staged trust removals for eMudhra roots, with Microsoft set to start removals on November 16 and Apple completing removals by November 30.
- The company has engaged KPMG for an independent review due December 4 and set an internal inventory deadline of November 30, and it reports no confirmed misuse of the compromised keys so far.
- The incident exposed gaps in change control and HSM-transfer procedures after an earlier June 2025 CRL anomaly went unexplained, and it raises risk for non-browser systems and legacy devices that may still trust revoked chains.