eMudhra emSign PKI Services: Failure to Update CA Owner Information in CCADB
The case reports that eMudhra emSign PKI Services had outdated contact information in the Common CA Database (CCADB). Mozilla’s thread states that on 7 October 2024 it was identified that the CCADB email intended for Certificate Problem Reporting was not kept up to date, even though the correct contact information was reflected in the CP/CPS. As a result, a certificate revocation request submitted on 31 August 2024 was delayed because it was sent to the general enquiry email address rather than the dedicated Certificate Problem Reporting channel. eMudhra initiated corrective action by updating the CCADB with the correct Problem Reporting contact details (with the CCADB update noted as completed on 10/09/2024 in the closure summary). The thread also describes remediation steps including introducing an internal procedure after a PA Committee meeting to review CCADB consistency when CP/CPS changes are made, and adding quarterly compliance audits to review both CP/CPS and CCADB entries. The bug is marked RESOLVED with resolution FIXED, and Mozilla indicated it would close the bug on 14-Feb-2025 unless issues or questions remained.
- A certificate revocation request was submitted but was delayed because it was sent to the general enquiry email instead of the dedicated Certificate Problem Reporting contact.
- eMudhra raised an external Bugzilla incident to report the delay in revocation handling.
- Corrective action was initiated to update the CCADB with the correct Problem Reporting contact details.
- The CCADB was updated with the correct Problem Reporting contact details.
- An internal procedure was introduced to ensure CCADB entries are reviewed for consistency when CP/CPS changes are published, with independent second-level verification.
- Mozilla planned to close the bug unless there were issues or questions.
- Emudhra representative — eMudhra reported that CCADB contact information for certificate problem reporting was outdated versus CP/CPS, causing revocation requests to be routed to the general enquiry channel and delaying handling.
- Emudhra representative — eMudhra requested the bug be closed if there were no further questions.
- Mozilla representative — Mozilla asked for a closure summary covering incident description, root cause(s), remediation, ongoing commitments, and an attestation that action items were completed.
- Emudhra representative — eMudhra provided an incident closure summary describing the CCADB update failure, root cause, remediation actions, and commitments including quarterly verification and training/resource measures.
- Mozilla representative — Mozilla stated it would close the bug on 14-Feb-2025 unless there were issues or questions.