Indian government sites are serving revoked eMudhra certificates https://captnemo.in/blog/2026/10/23/emsign-revoked-gov-in/

Indian government sites are serving revoked eMudhra certificatesOn 17th October, eight eMudhra intermediate CAs chaining to emSign ECC Root CA - G3 were found to have trivially recoverable private keys. They were revoked the next day, and Mozilla and Chrome are now distrusting the G3 root. Separately, on 19th October eMudhra revoked 9,356 certificates on its unaffected RSA hierarchy (emSign Root CA - G1) with the reason “Superseded”. That batch matches every unexpired certificate missing a certificate-type policy OID required by emSign’s own CP/CPS (Bug 2082782). captnemo.in