eMudhra emSign PKI Services: InCommon RSA IGTF Server CA 4 — certificate profile deviations from CPS key-size and extension requirements
eMudhra opened this incident after a Certificate Problem Report was received about certificates issued by InCommon RSA IGTF Server CA 4. The initial report said the CA issued subscriber TLS certificates with key types and key sizes other than the RSA 4096 key required by its CPS, including RSA 2048, RSA 3072, ECDSA P-256, and ECDSA P-384. In the full incident report, eMudhra said the certificate profile did not enforce the narrower CPS key-size requirement and that the deviation existed from the first subscriber certificate issued by the CA. eMudhra later updated the bug to say a second CPR also identified differences from the end-entity certificate profile in the CPS, including Certificate Policies, Key Usage, and CRL Distribution Points extensions, and that these differences also apply to certificates issued after issuance resumed on 2026-09-22. The company said issuance was stopped, the affected certificates were identified, and all affected certificates within their validity period were revoked. The bug remains assigned, with an updated full incident report promised.
- InCommon RSA IGTF Server CA 4 issued its first non-conformant subscriber certificate.
- A Certificate Problem Report was received about the CA issuing P-256 certificates contrary to the CPS.
- eMudhra applied a configuration change, stopped issuance from the CA, and later resumed issuance under the published CPS.
- All affected certificates that were still within their validity period were revoked.
- A second Certificate Problem Report identified additional differences from the CPS end-entity certificate profile.
- Emudhra representative — eMudhra filed a preliminary incident report describing non-conformant key sizes and stating that the issue was reported via a Certificate Problem Report.
- Emudhra representative — eMudhra said it was continuing internal analysis and would publish the full incident report within the expected timeline.
- Emudhra representative — eMudhra posted the full incident report, including the affected certificate counts, revocation status, and issuance halt details.
- Emudhra representative — eMudhra said it was working on the action items and would provide an update soon.
- Emudhra representative — eMudhra said it was working on the action items and would provide the update.
- Emudhra representative — eMudhra updated the bug to say a second CPR confirmed additional CPS profile differences and that an updated full incident report would follow.