eMudhra audit report reveals invalid CRL signatures and open PKI issues
kingslyj · x · 2026-10-24
Security researcher kingslyj found CRL-related issues in CA eMudhra's (emSign PKI) audit report and shared the disclosed Bugzilla list.
Issues include delayed publication of issuing CA certificates in CCADB, failure to respond to problem reports within 24 hours, invalid CRL signatures, delayed TLS certificate revocation, CRL URL mismatches, and an OCSP responder returning "Unauthorized" for some precertificates. Most are fixed, but several remain open, including the transition plan for dual-purpose roots and invalid Subject locality values. The author questions whether this was incompetence or potentially exploitable.
Related event: CA eMudhra Suffers Intermediate Key Leak, Audit Reveals More Issues(3 posts)→
More from Safety
- Ex-DOGE cyber researchers breach Anthropic systems with AI agents in under 12 hours — ScottNover · 2026-10-26
- Ofcom admits UK online safety laws failed to protect children in first review — gnukeith · 2026-10-26
- Sakana AI CEO Calls for Japan-US Shared Framework for AI Capability Evaluation — SakanaAILabs · 2026-10-26
- Gary Marcus backs call to outlaw voice cloning, citing scam and fraud harms over benefits — GaryMarcus · 2026-10-26
- Turing-complete malware can run in PyTorch's backward pass via a zero-valued loss — retr0jirachi · 2026-10-26
- ISO/IEC JTC 1/SC 42 holds 18th plenary on AI standards in Montreal — davidmanheim · 2026-10-26