Indian government sites still serve revoked eMudhra certificates
Original title: Indian government sites are serving revoked eMudhra certificates
Of 8,947 IGOD hosts checked on October 23, 156 still presented certificates revoked on October 19.
On October 17, eight eMudhra intermediates under emSign ECC Root CA - G3 were found to have trivially recoverable private keys, revoked the next day, with Mozilla and Chrome distrusting that root. On October 19 eMudhra also revoked 9,356 certificates on the RSA emSign Root CA - G1 hierarchy as superseded. MeitY called the impact limited and brief; the author says keys dated to April 2025 and that Indian government sites, including STPI, Bhashini, UIDAI and the Controller of Certifying Authorities, were still serving revoked certificates days later.
Unconfirmed: MeitY says the impact was very limited and brief; the author disputes both points and does not report confirmed misuse of the keys.
- eMudhra estimates about 30,000 G3 certificates must be migrated after root distrust.
- The author says most of those appear to be US university certificates via InCommon.
- The 156 still-revoked government certificates were revoked between 15:34 and 15:49 CEST on October 19.
- The G1 batch matches unexpired certificates missing a required certificate-type policy OID.
Impact: Recoverable intermediate CA keys; sites still present revoked TLS certificates
| Product | Affected |
|---|---|
| eMudhra emSign ECC Root CA - G3 | eight intermediate CAs with recoverable keys |
| eMudhra emSign Root CA - G1 | 9,356 certificates revoked as superseded |
- 1.Replace TLS certificates revoked on the eMudhra G1 hierarchy that sites still serve.
- 2.Migrate certificates that must move off the distrusted emSign ECC Root CA - G3.
- Vendors
- eMudhra
- Countries
- IndiaUnited States
From the original article
10 min read at captnemo.inOn 17th October, eight eMudhra intermediate CAs chaining to emSign ECC Root CA - G3 were found to have trivially recoverable private keys . They were revoked the next day, and Mozilla and Chrome are now distrusting the G3 root. Separately, on 19th October eMudhra revoked 9,356 certificates on its unaffected RSA hierarchy (emSign Root CA - G1) with the reason “Superseded”.
By captnemo.in via adityaathalye · captnemo.in
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.