eMudhra Revokes Eight Intermediate CAs After Internal Script Exposes Private Keys

What happened

A flawed Python script logged eight intermediate CA private keys to an unsecured network share; eMudhra revoked those CAs and offered re‑issuance of affected certificates.

Why it matters for trust and compliance

• The incident reveals a weakness in cryptographic key‑lifecycle management; continuous monitoring and evidence collection can demonstrate control assurance across frameworks.
• Demonstrates the need for continuous monitoring of key‑handling processes and audit‑ready evidence.
• Highlights the value of mapping key‑management controls to a unified framework for multi‑framework assurance.

Who is affected

Recommended actions

1. Validate that your certificates do not chain to the revoked intermediates.
2. Re‑issue any affected certificates from an unaffected CA.
3. Audit your own key‑management and secret‑handling scripts for similar gaps.
4. Implement continuous monitoring of cryptographic material access.