The security of eight eMudhra intermediate certificate authority (CA) certificates has been compromised, as confirmed by Mozilla and Google’s Chrome Root Program on October 20.
An intermediate CA plays a crucial role in signing the certificates that websites present, allowing anyone with these compromised keys to issue certificates for any website accepted by a browser.
The compromise was reported by a researcher to the root programs on October 17, leading to the prompt blocking of the eight certificates by Chrome and Firefox shortly after verification by Chrome.
Prior to Chrome’s block, no TLS certificate chaining to the six intermediates used for websites had been logged to Certificate Transparency (CT), making them untrusted by default in Chrome and other browsers requiring CT logging.
The origin of how the keys left eMudhra, when it happened, and whether anyone else besides the researcher possesses them remains unknown.
Details of the Compromised Certificates
eMudhra, an Indian CA, sells certificates under the emSign brand through various companies globally and has roots in major root stores like Mozilla, Chrome, and Apple. The eight compromised certificates include TLS domain-validated, organization-validated, extended validation, and code-signing certificates.
Notably, the six TLS certificates were issued by emSign Root TLS CA – G3 and chain to emSign ECC Root CA – G3, a root present in Chrome and Apple stores until October 20 and Mozilla’s store previously.
All eight certificates also have cross-signed copies by Sectigo under its AAA Certificate Services root, as per a certificate list shared by a Mozilla cryptography engineer.
Chrome did not deem it necessary to block the code-signing certificates, as its TLS verifier does not establish a path through an intermediate restricted to code signing.
Actions Taken for Protection
Upon receiving the report, the Chrome Root Program swiftly updated its CRLSet to block the six TLS intermediates, while Mozilla integrated a OneCRL block into Firefox installations with standard settings.
Various software and platforms have released updates to address the compromised certificates, either by rejecting specific keys or removing roots associated with them.
Resolving the Issue
For individuals managing trust stores, Mozilla recommends taking necessary actions based on the software’s ability to block individual intermediates or considering removing trust in roots associated with the compromised certificates.
Updates have been rolled out for different software, each addressing the issue uniquely to prevent potential misuse of compromised keys.
Further investigations are ongoing to determine the root cause of the incident and prevent similar occurrences in the future.
