eMudhra Revokes Eight Additional Intermediate Certificates After Private‑Key Exposure

What happened

eMudhra discovered that a custom Python script used for key transfers loaded private‑key components into host memory, exposing six TLS and two code‑signing intermediate certificates. The company revoked the eight certificates on Nov 7 2026 and is replacing them for affected customers.

Why it matters for trust and compliance

• The incident demonstrates why organizations must enforce strict cryptographic‑key lifecycle controls and retain continuous, auditable evidence of key‑handling practices.
• Map cryptographic‑key protection controls to your audit framework and collect continuous evidence.
• Leverage a Trust Center to demonstrate defensible key‑management processes to regulators and partners.

Who is affected

Recommended actions

1. Replace any eMudhra‑issued certificates with the newly issued replacements.
2. Audit your own key‑management procedures for memory‑scrubbing and segregation of duties.