2090128 - eMudhra: Series A intermediates missing from 2024-25 audit reports

Status: ASSIGNED

(CA Program :: CA Certificate Compliance, task)

Description

[Parikshith]

Steps to reproduce

1. Checked CCADB records for the eMudhra Series A intermediates(issued 2025-04-30, revoked 2025-05-30 per attachment 9670867 [details], Q11). All are marked "Audits Same as Parent".

EM DV TLS CA - G2A D6961022F9A55BBDE793D1BC696D73D7C2569AD55F0FD59910AF45449CD9CAB6
EM OV TLS CA - G2A F95D99B74A0FC39B8FF1316523B0E99F514A8187BB94540EBAEBA636D4E42121
EM EV TLS CA - G2A 6984C2CCC0749F56449DE150C23975EFDC4D311E90308A622C3641D5ABB4312D
EM DV TLS CA - G3A C83980CF0440CDEA950BE2C13CC1090F04B8D77E0D50E977588DBDDB11CC6DA9
EM OV TLS CA - G3A 775BB88FB7FECCCA55B5B216DF40A23F52129EF647EA2077CADDEE798DEF9EB0
EM EV TLS CA - G3A 8344188BCBD9CECB9397436878DE8918D6D4521EFDB6BDE2A30E520847F22901
EM OV CS CA - G2A D5B4A8E4B3E881B6747FDD8A8E8996CD194C016F18BD745FE9F5E09E6B2F23B6
EM OV CS CA - G3A 4FFC3046410087C23D2873CD947C8C25422114254BC1567D4C33F35723EBA93B

2. Searched the 2024-25 (2024-06-01 to 2025-05-31) audit reports for these fingerprints:

Standard: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270
TLS BR: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6444f3a4-f604-4336-938e-a4985d4d2474
TLS EVG: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=07374f3b-d286-45a5-a989-6f9640f94994
NetSec: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc9571e-aabc-44c0-a994-786ed27d4713
Code Signing: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=895ed837-708e-421d-bf05-7f6e56b8197a

3. On 2026-11-03 [05:51] UTC, sent a Certificate Problem Report about this to [e-mail].

Actual results

• None of the eight fingerprints is listed in any of the five 2024-25 reports. The reports do list the A-1, B and C series, including the B and C series from the same 2025-04-30 ceremony.
• No response or acknowledgement to the Certificate Problem Report has been received.

Expected results

• Intermediates valid during an audit period should be listed in the corresponding audit reports.
• A preliminary response to the Certificate Problem Report within 24 hours (TLS BR 4.9.5).

Questions for eMudhra:

1. Which audit report, if any, covers these certificates?
2. Did the auditor witness or report on the 2025-04-30 key generation ceremony?

See Also: Bug 2083449, Bug 1965559, Bug 1970727

Comment 1

[Parikshith]

I sent the following email to [e-mail] on 2026-11-03 at 05:51 UTC. I haven't gotten a response as of 1530 UTC today (2026-11-06).

Hello,

The eight Series A intermediates generated on 30 April 2025 and revoked in May 2025 do not appear in any WebTrust audit report (2023-24, 2024-25, 2025-26), although they were valid during the 2024-2025 period. CCADB marks them as "Audits Same as Parent".

EM DV TLS CA - G2A D6961022F9A55BBDE793D1BC696D73D7C2569AD55F0FD59910AF45449CD9CAB6
EM OV TLS CA - G2A F95D99B74A0FC39B8FF1316523B0E99F514A8187BB94540EBAEBA636D4E42121
EM EV TLS CA - G2A 6984C2CCC0749F56449DE150C23975EFDC4D311E90308A622C3641D5ABB4312D
EM DV TLS CA - G3A C83980CF0440CDEA950BE2C13CC1090F04B8D77E0D50E977588DBDDB11CC6DA9
EM OV TLS CA - G3A 775BB88FB7FECCCA55B5B216DF40A23F52129EF647EA2077CADDEE798DEF9EB0
EM EV TLS CA - G3A 8344188BCBD9CECB9397436878DE8918D6D4521EFDB6BDE2A30E520847F22901
EM OV CS CA - G2A D5B4A8E4B3E881B6747FDD8A8E8996CD194C016F18BD745FE9F5E09E6B2F23B6
EM OV CS CA - G3A 4FFC3046410087C23D2873CD947C8C25422114254BC1567D4C33F35723EBA93B

Could you please confirm whether these intermediates were in scope for an audit, and if so, which report covers them?

Links:
[0] Audit url 2023-2024 -https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bff845df-7291-44d0-9c12-fbc8aed1d084
[1] Audit url 2024-2025 - https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270
[2] Audit url 2025-2026 - https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d8070c2-71d2-4f93-bd21-e79f18dbe93d

Regards,
Parikshith