eMudhra ACME workflow added unrequested “www” SAN entries; incident report completed and pending closure
This case concerns eMudhra’s ACME issuance workflow automatically appending the corresponding “www” label to certificates requested for a base domain only. The issue was triggered by a customer complaint and eMudhra said the added name was not explicitly requested or authorized by the subscriber. eMudhra clarified that domain control validation was performed using DNS TXT record-based validation and that the problem was limited to subscriber authorization, not domain validation. The company reported that 239 TLS/SSL DV and OV end-entity certificates were affected, disabled the ACME auto-addition logic on 2026-05-30, and revoked all 239 valid affected certificates by 2026-06-02 19:15 UTC. eMudhra then completed all listed remediation items, including the pre-issuance SAN-vs-CSR gate, the non-ACME channel audit, and post-issuance monitoring. On 2026-09-07 eMudhra posted a closure summary requesting closure, and on 2026-09-08 CCADB issued a final call for comments with closure expected around 2026-09-14.
- Earliest affected subscriber certificate was issued via ACME with an unrequested “www” SAN added to a base-domain request.
- eMudhra disabled the ACME www auto-addition logic.
- All 239 valid affected certificates were revoked.
- eMudhra completed the pre-issuance SAN-vs-CSR validation gate.
- eMudhra completed the audit of non-ACME issuance channels.
- eMudhra completed automated post-issuance monitoring for SAN entries outside CSR scope.
- eMudhra posted a closure summary and requested closure of the incident report.
- Emudhra representative — Filed a preliminary incident report describing the ACME workflow’s automatic inclusion of “www” in the SAN for base-domain requests.
- Emudhra representative — Submitted the full incident report stating that 239 certificates were affected and all valid affected certificates were revoked by 2026-06-02 19:15 UTC.
- Mozilla representative — Asked eMudhra to clarify which ACME validation method was used and whether the automatically added “www” identifier was separately validated before issuance.
- Emudhra representative — Confirmed DNS TXT record-based validation was used and said the incident was limited to subscriber authorization, not domain validation.
- Emudhra representative — Reported that the pre-issuance SAN-vs-CSR validation gate was complete, while non-ACME channel audit and post-issuance monitoring were still in progress.
- Emudhra representative — Posted a status update marking the non-ACME channel audit complete and leaving automated post-issuance monitoring ongoing.
- Emudhra representative — Requested that the Next Update field be set to 2026-08-31.
- Emudhra representative — Posted a status update marking the post-issuance monitoring action item complete.
- Emudhra representative — Posted a report closure summary stating that all action items were complete and requesting closure.
- CCADB representative — Posted a final call for comments or questions and said the report would be closed around 2026-09-14.