eMudhra emSign PKI Services: Invalid Subject Locality/State Values incident report closed after remediation
eMudhra opened this bug to disclose a certificate incident after receiving two external Certificate Problem Reports about publicly trusted OV and EV TLS server certificates issued by emSign. The reports concerned non-conformant Subject DN values: an extraneous "=" in subject:stateOrProvinceName and composite locality strings with embedded commas in subject:localityName. eMudhra said a scan of issued certificates found 291 affected certificates in total, and that the active affected certificates were revoked by 2026-07-27. The company reported interim manual review controls, then permanent input-validation, pre-issuance linting, and self-audit enhancements, all marked complete by 2026-08-31. In its 2026-09-07 closure summary, eMudhra stated that all action items were complete and requested closure. CCADB then posted a final call for comments and said the incident report would be closed around 2026-09-14; the bug is now RESOLVED/FIXED.
- eMudhra received two external Certificate Problem Reports about invalid Subject DN values in publicly trusted TLS server certificates.
- eMudhra opened a preliminary incident report and began investigating scope and root cause.
- eMudhra completed revocation of the active affected certificates.
- eMudhra filed a full incident report stating that 291 certificates were affected.
- eMudhra marked the remaining remediation action items complete.
- eMudhra submitted a report closure summary requesting closure of the incident report.
- The bug status changed to RESOLVED with resolution FIXED.
- Emudhra representative — Naveen Kumar ML filed a preliminary incident report describing the two CPRs and the suspected Subject DN validation issue.
- Emudhra representative — Naveen Kumar ML posted the full incident report with affected-certificate counts, revocation completion date, and interim manual review control.
- Emudhra representative — Naveen Kumar ML posted a status update showing several remediation action items as complete and others ongoing.
- Emudhra representative — Naveen Kumar ML provided an updated action-item table while saying the team was still working on the remaining item.
- Emudhra representative — Naveen Kumar ML posted a status update showing all listed action items completed.
- Emudhra representative — Naveen Kumar ML posted a report closure summary stating that all action items were complete and requesting closure.
- CCADB representative — CCADB posted a final call for comments or questions and said the incident report would be closed around 2026-09-14.