eMudhra incident report: subordinate CA certificates missing EKU extension
eMudhra opened this bug as a preliminary incident report about seven subordinate CA certificates issued under emSign Root CA – C1 on 2026-08-06 that were found to be missing the Extended Key Usage extension. The report says the subordinate CAs were created for document signing and trust services and were not intended for TLS issuance. It also states that none of the affected subordinate CAs had issued any end-entity certificates. The report cites Mozilla Root Store Policy section 5.3 and CA/Browser Forum TLS Baseline Requirements section 7.1.2 as the relevant policy requirements. The thread notes that eMudhra had already initiated a root distrust and transition plan under Mozilla Bug 2018979 before these subordinate CAs were issued. The bug remains assigned, and the only thread content provided is the initial disclosure.
- Seven subordinate CA certificates were issued under emSign Root CA – C1 without the EKU extension.
- eMudhra filed a preliminary incident report describing the missing-EKU subordinate CA certificates.
- Emudhra representative — Filed a preliminary incident report stating that seven subordinate CA certificates were missing EKU, that none had issued end-entity certificates, and that the issue was disclosed as an external third-party report.