SFLC.in is alarmed by reports that several Indian government websites are reportedly still using security certificates that eMudhra revoked and marked as ’superseded’ on 19 October 2026.
eMudhra marked these certificates as “superseded” because they had been replaced, however the replacement was never installed on the server. This means the certificates had been revoked, but the websites were still presenting them to visitors. According to infosec researcher Nemo’s investigation, 773 government websites were affected and were still serving these revoked certificates as of 25 October. SFLC.in has also verified that the many of the government websites listed continue to serve these revoked certificates as of 28 October, 5 days after the initial report.
The continued deployment of such certificates on government websites that provide judicial, regulatory, welfare, identity-related or other important public services, is especially concerning. This would allow threat actors to capture sensitive data that users use to login, issue fraudulent certificates to malicious websites that pretend to be official government portals.
SFLC.in has urged MeitY and CERT-In to ensure affected government websites replace revoked certificates, publish a verified list of affected and remediated domains, investigate the delay in replacing certificates, and release an Action Taken Report outlining steps taken and planned. We have also called on eMudhra to investigate the incident and explain why revoked certificates continued to be served.
Find both letters below:
