Eight eMudhra CA Keys Compromised, Triggering Emergency Browser and Software Patches
Security researchers and browser vendors scramble to revoke compromised intermediate certificate authority keys.
1Compromised Intermediate CA Keys
On October 20, Mozilla and Google confirmed that eight intermediate certificate authority keys belonging to eMudhra were compromised. These keys, if misused, would allow an attacker to issue fraudulent certificates for any website. The breach was reported on October 17 by a researcher who verified the compromise by signing messages with the keys.
2Rapid Browser Response Mechanism
Chrome and Firefox acted within hours of the report to block the affected certificates. Chrome utilized its CRLSet mechanism, while Firefox pushed updates via OneCRL. These automated systems allowed browsers to revoke trust without requiring a full software restart or user intervention, effectively mitigating the immediate risk of rogue certificate acceptance.
3Scope of the Compromise
The eight compromised certificates include six TLS certificates and two code-signing certificates. While Chrome blocked the TLS intermediates, it deemed the code-signing certificates less critical because its verifier does not build paths through those specific intermediates. eMudhra has since revoked all eight certificates, and Apple and Microsoft have also implemented blocks.
4Cross-Signed Certificate Complications
Each of the eight certificates had a copy cross-signed by Sectigo under its AAA Certificate Services root. Chrome’s block specifically targets the public keys, ensuring that even these cross-signed copies are invalidated. Mozilla and Chrome have confirmed that no other certificate authorities appear to be affected by this specific failure mode.
5Software Ecosystem Vulnerabilities
While browsers handle revocation well, many other applications using libraries like Python’s certifi or Go binaries do not check revocation data. Consequently, these systems remain vulnerable until their root bundles are manually updated. Filippo Valsorda noted that Linux root stores are often too poorly maintained to rely on standard revocation updates.
6Emergency Mitigation Strategies
To address the risk in non-browser software, maintainers are removing the emSign ECC Root CA - G3 from trust bundles. This drastic measure ensures security but disrupts legitimate services that rely on these roots. Mozilla and Homebrew have adopted this approach, acknowledging that some servers will become unavailable until they update chains.
7Ongoing Investigation and Transparency
The exact timeline and method of the key exfiltration from eMudhra remain unknown. Mozilla is currently collaborating with eMudhra and other root programs to identify the root cause. As of October 20, eMudhra had not published a formal notice regarding the incident in its own trust-services repository or public channels.
8Long-Term Trust Store Impact
The incident has prompted a re-evaluation of eMudhra’s standing in major root stores. Chrome plans to remove the emSign ECC Root CA - G3 in version 43 and is reviewing the status of the emSign Root CA - G1. This event highlights the fragility of the global trust chain when intermediate keys fail.