INDIAN GOVERNMENT SITES ARE SERVING REVOKED EMUDHRA CERTIFICATES

Summary from the TLDR InfoSec newsletter

Over 800 Indian government domains, including UIDAI and the Controller of Certifying Authorities that regulates eMudhra, were still serving certificates days after eMudhra revoked 9,356 of them on its unaffected emSign G1 RSA hierarchy. The mass revocation followed the discovery of trivially recoverable private keys in eight intermediates under emSign ECC Root CA G3, flaws that went unnoticed for 18 months and contradicted MeitY's claim of a limited, brief impact. Firefox's CRLite blocks the affected sites, but Chrome's CRLSet omits these revocations entirely, so Chrome, Edge, Android, and Safari on iOS load most of them without complaint.