eMudhra are now blocking access to their certificate revocation list
Comments on “eMudhra are now blocking access to their certificate revocation list”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
A Mozilla Bugzilla report says eMudhra's revocation hosts (crl, ocsp, ocsp-b, repository) return 403 over HTTP to clients whose User-Agent contains curl, Wget, Python-urllib or libwww-perl, while other agents get valid CRLs. The reporter says this includes CRLs for the eight compromised intermediates, and cites 417 of 417 refused requests. The test data is the reporter's own, and the claim check could not verify these figures independently. For anyone building certificate-checking software, a default HTTP client may fail to fetch revocation data, and no eMudhra reply was recorded.
Why it ranked
No. 14 of 155 with a score of 0.69. The panel rated it highest on substantiated (0.94) and new information (0.90), lowest on audience breadth (0.55).
- AI judgeJudge 2claude-haiku-5-5
- Detailed, well-evidenced Bug Bounty/CCADB report on a CA blocking CRL/OCSP access by User-Agent. Strong security and PKI policy relevance, substantiated with traces, but narrow audience and a bug-tracker format.
- AI judgeJudge 3gpt-5.6-luna
- A rigorously documented CA revocation-access failure affecting automated certificate checking, with reproducible request comparisons, broad endpoint coverage, standards requirements, and evidence of persistent blocking.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.69total under rubric v2.2
- Significance0.67
- Reader interest0.73
- Audience breadth0.55
- Practical relevance0.69
- Substantiated0.94
- Technical depth0.88
- New information0.90
- Counts against: Promotional0.03
- Counts against: Overclaim0.17
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.61 | 0.62 | 0.78 | 0.67 | 0.17 | +0.24 | +0.161 |
| Reader interest | 0.69 | 0.60 | 0.90 | 0.73 | 0.30 | +0.26 | +0.190 |
| Audience breadth | 0.45 | 0.55 | 0.64 | 0.55 | 0.19 | +0.13 | +0.071 |
| Practical relevance | 0.72 | 0.55 | 0.80 | 0.69 | 0.25 | +0.22 | +0.152 |
| Substantiated | 0.97 | 0.90 | 0.95 | 0.94 | 0.07 | +0.05 | +0.047 |
| Technical depth | 0.99 | 0.75 | 0.90 | 0.88 | 0.24 | +0.05 | +0.044 |
| New information | 0.86 | 0.85 | 0.99 | 0.90 | 0.14 | +0.05 | +0.045 |
| Promotional | 0.05 | 0.02 | 0.01 | 0.03 | 0.04 | −0.19 | −0.005 |
| Overclaim | 0.23 | 0.20 | 0.08 | 0.17 | 0.15 | −0.11 | −0.019 |
| Sum of contributions | +0.686 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.686 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-28/14/"><img src="https://rubric.hrih.si/badge/2026-10-28/14.svg" alt="Ranked #14 on Rubric, 28 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 1 matches source · 5 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkNumber
As of checks at 04:16 UTC on 25 October 2026, eMudhra's servers blocked access to crl.emsign.com, ocsp.emsign.com, ocsp-b.emsign.com and repository.emsign.com for the default cURL, wget and Python urllib User-Agent headers.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “eMudhra's servers blocks access to the following hosts with the default cURL, wget, and Python's urllib User-Agent header”
The source says No passage could be compared.
Source cited by the article: bugzilla.mozilla.org/show_bug.cgi
No source givenNumber
On the five filtered hostnames, curl was refused 417 of 417 times while check/1 got valid data 417 of 417 times, covering 145 CRL URLs, 59 CA certificate URLs and OCSP checks for 104 certificates.
The article gives no link or citation for it.
The article says “On the five filtered hostnames, curl was refused 417 of 417 times, covering 145 CRL URLs, 59 CA certificate URLs and OCSP checks for 104 certificates”
The source says No source to compare with.
No source givenCausal conclusion
The eMudhra firewall refuses requests whose User-Agent contains curl, Wget, Python-urllib or libwww-perl, returning a 403 page saying the transfer is blocked by a Web Application Firewall.
The article gives no link or citation for it.
The article says “A request is refused when its User-Agent contains one of these client names; a client that renames itself gets through”
The source says No source to compare with.
Couldn’t checkNumber
The CRLs roottlscag3.crl and rootcscag3.crl, which carry the eight cACompromise entries, and all eight intermediates' own CRLs are refused to these clients.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “roottlscag3.crl and rootcscag3.crl, which carry the eight cACompromise entries in Bug 2083449 comment 10, are refused, as are all eight intermediates' own CRLs”
The source says No passage could be compared.
Source cited by the article: bugzilla.mozilla.org/show_bug.cgi
No source givenGeneralization
DigiCert, Sectigo, GlobalSign, SSL.com, Google Trust Services, Let's Encrypt, GoDaddy and Amazon each served every User-Agent tested on their revocation endpoints.
The article gives no link or citation for it.
The article says “DigiCert, Sectigo, GlobalSign, SSL.com, Google Trust Services, Let's Encrypt, GoDaddy and Amazon each served every User-Agent tested on their revocation endpoints”
The source says No source to compare with.
No source givenNumber
www.microsoft.com (Akamai) returns 403 to the Wget User-Agent on its CRL and CA-certificate paths, affecting 2,355 of its 3,862 own-domain CRL URLs, while crl2.microsoft.com is unaffected.
The article gives no link or citation for it.
The article says “2,355 of its 3,862 own-domain CRL URLs -- while serving curl and other clients; its dedicated crl2.microsoft.com is unaffected”
The source says No source to compare with.
Matches sourceQuote
eMudhra stated in comment 43 that revocation status had been available via CRL and OCSP since the revocation, which the author says was inaccurate for relying-party software built on the blocked clients.
The cited source says the same thing.
The article says “Revocation status has been available via CRL and OCSP since that point”
The source says “Revocation status has been available via CRL and OCSP since that point”
Source cited by the article: bugzilla.mozilla.org/show_bug.cgi
No source givenDate
The filter remained unchanged when re-probed at 00:49 UTC on 26 October, and eMudhra had not replied to comment 44.
The article gives no link or citation for it.
The article says “The filter was unchanged 13 hours after that, and still unchanged when re-probed the next day at 00:49 UTC on 26 October”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 19 pts, not on front page
Recorded for context only, checked 28 Oct 2026, 06:47 UTC. It played no part in the ranking.