eMudhra self-reported issuance of test-website TLS certificates with unauthorized clientAuth EKU; incident report closed after final call for comments

eMudhra reported a self-discovered incident involving TLS leaf certificates issued for its own emSign test websites. The certificates were issued from a dedicated test-website profile that, according to the emSign SSL/TLS CP/CPS, should have been limited to serverAuth, but the affected certificates also contained clientAuth in the EKU extension. The Full Incident Report states that five certificates were affected, all for emSign-operated test URLs under the emsign.com domain, and that no subscriber certificates were impacted. eMudhra said the issue was found internally during post-issuance monitoring on 2026-08-26, the defective profile was disabled on all issuing CAs, and all five affected certificates were revoked on 2026-08-26 within 8 minutes and 18 seconds. eMudhra later marked the mitigation, prevention, and detection action items complete and posted a closure summary requesting closure. CCADB then issued a final call for comments on 2026-09-30 and said the incident report would be closed on approximately 2026-10-07 if there were no further comments.

1. 2026-08-25 TLS leaf certificates for emSign test websites were issued with both serverAuth and clientAuth EKUs.
2. 2026-08-26 eMudhra internally detected the EKU deviation during monitoring and revoked the affected certificates.
3. 2026-09-09 eMudhra posted the Full Incident Report stating five certificates were affected and the defective profile was disabled.
4. 2026-09-25 eMudhra reported that the mitigation, prevention, and detection action items were complete.
5. 2026-09-29 eMudhra posted a report closure summary requesting closure after completing all action items.

1. 2026-08-26 Emudhra representative — Filed a preliminary incident report describing four TLS leaf certificates for internal test websites with clientAuth added in violation of the CP/CPS.
2. 2026-09-03 Emudhra representative — Said internal analysis was continuing and the Full Incident Report would be published within the expected timeline.
3. 2026-09-09 Emudhra representative — Posted the Full Incident Report, stating that five certificates were affected, all were revoked, and the defective profile was disabled.
4. 2026-09-17 Emudhra representative — Said the team was working on the action item and would provide an update.
5. 2026-09-23 Emudhra representative — Said the team was still working on the action item and would share the update once completed.
6. 2026-09-25 Emudhra representative — Posted a status update marking the mitigation, prevention, and detection action items as complete.
7. 2026-09-29 Emudhra representative — Posted a report closure summary stating that all action items were completed and requesting closure.
8. 2026-09-30 CCADB representative — Issued a final call for comments or questions and said the incident report would be closed on approximately 2026-10-07.