That last claim is wrong on both counts. The interval wasn’t short: the flawed keys were generated in April 2025, so anyone could have recovered them for 18 months before the report. The impact isn’t limited either: the compromised intermediates barely issued anything, but Mozilla and Chrome are now distrusting the entire G3 root, so eMudhra estimates 30,000 certificates from its unaffected G3 intermediates must be migrated. From what I could see, most of those seem to belong to US universities using eMudhra through InCommon rather than Indian sites.

Meanwhile, the 19th October revocations have left Indian government sites serving revoked certificates days later, including four bodies under MeitY itself: STPI, Bhashini, UIDAI, and the Controller of Certifying Authorities, whose India PKI site is serving a revoked eMudhra certificate. Notably, Controller of Certifying Authorities regulates eMudhra’s CA business in India.

I checked the 8,947 hosts in the IGOD directory of Indian government websites. As of 23rd October, 156 of them are still serving one of these revoked certificates. All of them were revoked between 15:34 and 15:49 CEST on 19th October, and are listed in eMudhra’s CRLs for DV/G2A-1, OV/G2A-1, EV/G2A-1 and G1.

Whether these sites open depends on your browser. Firefox ships CRLite, which covers every revocation, and refuses to load them. Chrome’s CRLSet (version 10856, 24th October) has none of these certificates, nor any of the 6,235 entries on the DV/G2A-1 CRL, so Chrome, Edge and Android load them fine. So does Safari on iOS, which only checks OCSP for EV certificates. Two sites on the list have one: www.isea.gov.in and nfscnagpur.nic.in, and emSign’s OCSP responder reports the isea.gov.in certificate as revoked, so Safari on iOS refuses to load it. SSL Labs checks the CRL itself and marks all of these as Grade F / revoked.

Revocations happen (GoDaddy just revoked 4 lakh certificates), but they are usually accompanied by notifications to subscribers to get them to new valid certificates. I’m not sure if eMudhra is doing any of the sort, now that they don’t care about their TLS business.

The table will be updated with timestamps as cert rotations happen.

Published on October 23, 2026

By Nemo