Certificate Authority's Python script slashes its own keys to one byte.

Certificate authority eMudhra has revoked eight more of its own intermediate certificate authorities after discovering they were compromised by a flawed internal Python script. The script, used to transfer keys between hardware security modules during a practice run in April, had a single line of code that truncated each private RSA key to just one byte, rendering them cryptographically useless. The company had previously declared these CAs 'unaffected' by a separate October key compromise incident.

For engineers and users, this means 195 certificates issued by these eight CAs are now revoked, including 29 for eMudhra's own domains and certificates used for website TLS and code signing. The company's internal controls failed at multiple levels: disabling FIPS-approved security modes, skipping validation checks, and mislabeling the compromised keys. The takeaway: even certificate authorities can't trust their own automation when one line of buggy code can undermine their entire security foundation.