eMudhra revoked eight additional intermediate certificates on Nov. 7 after a software flaw exposed private key material during a certificate-generation process in April 2025, bringing the total affected intermediate certificates to 16. The revocation covers six TLS-issuing CAs and two code-signing CAs, four of which entered production in May, and the CAs had issued 195 certificates, including 29 for eMudhra’s own domains. The flaw stemmed from a custom Python script that transferred keys between hardware security modules and inadvertently extracted private key components into host memory; while the RSA keys were not truncated, the company could not verify that handling met its own encryption key practices. eMudhra said affected certificate holders have been moved to replacement certificates, will complete an inventory of its certificate keys by Nov. 30, and KPMG is conducting an independent review expected to conclude by Dec. 4. 1