eMudhra CPS disclosure gap: missing Baseline Requirements conformance statement and root program references
This case concerns a disclosure gap in eMudhra’s InCommon IGTF SSL CPS v3.03. The CPS did not include a general statement that the CA conforms to the CA/Browser Forum Baseline Requirements, nor did it reference the applicable root store programme policies or CCADB. The CA stated that its practices were already carried out in accordance with those requirements and that no certificates were affected. The issue was raised alongside a Certificate Problem Report received at p**********g@emsign.com on 2026-09-16, and the CA acknowledged it the same day. The revised CPS published on 2026-09-21 added the conformance statement, precedence clause, and the missing references. The bug remains ASSIGNED, and the thread records follow-up action items as complete.
- InCommon RSA IGTF Server CA 4 began operating under the CPS that lacked the required disclosure statements.
- A report was received at p**********g@emsign.com noting the missing Baseline Requirements and root store policy disclosures.
- A revised CPS was published with the conformance statement, precedence clause, and references to the root store programme policies and CCADB.
- Emudhra representative — Posted a preliminary incident report saying the CPS had a disclosure gap, no certificates were affected, and the issue was raised alongside a Certificate Problem Report.
- Emudhra representative — Said the team was continuing its internal review and would publish the full incident report within the required timeline.
- Emudhra representative — Posted the full incident report describing the missing conformance statement, precedence clause, and policy references, and noting the revised CPS had been published.
- Emudhra representative — Provided a brief update that the team was working on the action items.
- Emudhra representative — Posted a status update showing the review, drafting, publication, and checklist action items as complete.