Indian government sites are serving revoked eMudhra certificates

On 17th October, eight eMudhra intermediate CAs chaining to emSign ECC Root CA - G3 were found to have trivially recoverable private keys. They were revoked the next day, and Mozilla and Chrome are now distrusting the G3 root. Separately, on 19th October eMudhra revoked 9,356 certificates on its unaffected RSA hierarchy (emSign Root CA - G1) with the reason “Superseded”. That batch matches every unexpired certificate missing a certificate-type policy OID required by emSign’s own CP/CPS (Bug 2082782). On 21st October, MeitY posted this thread: A security incident concerning eMudhra’s Public Key Infrastructure (PKI) was reported in the public domain. […] However, some social media accounts are indulging in fear mongering about the impact of this incident. […] The impact of this incident on Indian websites and applications have been very limited and for a very short interval. — @GoI_MeitY, 21st October 2026, 16:31 CEST That last claim is wrong on both counts. The interval wasn’t short:…