eMudhra Replaces Six Invalidly Signed CRLs After Manual Key Configuration Error

Certificate authority eMudhra published six certificate revocation lists (CRLs) with invalid ECDSA signatures on May 29, 2025, after a manual signing workflow used incorrect CA key configurations. Clients could not validate the affected CRLs, but the issuing intermediate CAs had not issued any end-entity certificates, limiting operational impact. Sectigo reported the problem externally; eMudhra’s email filters quarantined the initial notification, delaying internal awareness.

eMudhra published correctly signed replacement CRLs on June 6, 2025, at 07:30 UTC. The company subsequently reported introducing automated CRL generation, mandatory post-signing cryptographic verification, and daily reviews of quarantined email. Mozilla Bugzilla issue 1970728 was resolved as fixed. The incident highlights the importance of validating revocation artifacts before publication and ensuring external security reports reach responders.