A Buggy Script Cut eMudhra Keys to Just One Byte, Triggering Its Certificate Exit

Former certificate authority eMudhra has revealed the technical failure behind its release of severely flawed digital certificates. In an incident report on Bugzilla, the company blamed a custom Python script for cutting private encryption keys down to a single byte.

How a Moving Process Broke Key Security

The problem occurred during a key-generation ceremony on April 30, 2025. eMudhra sought to produce sixteen issuing key pairs. These were supposed to include eight ECDSA P-384 private keys, which normally require a length of 48 bytes.

Hardware shortages forced the company into an unusual setup. Because it could not get the specific hardware security modules it wanted for United States operations, eMudhra created the keys on devices from Utimaco. It then planned to transfer them into hardware from Crypto4A to meet an end-of-May deadline.

To transfer the keys between different devices, the team used a custom Python import script. A coding defect in this script read back unwrapped data incorrectly and truncated the private value. The code ignored 47 out of the 48 bytes, creating keys as simple as the number four.

Revocation and Market Exit

The company did not test the keys it generated and failed to catch the error. A team member at Mozilla discovered the flaw. Because the keys were so short, outsiders could easily calculate them from public data. Attackers could have abused the bad certificates to impersonate web servers, intercept encrypted traffic, or alter data.

Web browsers moved quickly to distrust certificates from eMudhra. Following the incident, the Indian company left the SSL and TLS certificate authority market entirely. It stated that this segment was not a major revenue driver and outlined steps to wind down operations while improving its broader security processes.