eMudhra ignored Mozilla Root investigation deadline; blames social media

Certificate authorities that experience private key compromises will have their certificates distrusted, impacting trust for all services using them.

Mozilla received a report on October 17th regarding a compromise of the private keys for eight eMudhra Intermediate certificates. The report, originating from Wayne and forwarded by the Chrome Root program, included proof of key control for these certificates. Mozilla acknowledged the report, confirmed the proof, and initiated the process to distrust the certificates in Firefox within three hours. eMudhra also acknowledged the report and stated they were investigating and had notified Sectigo, as some certificates were cross-signed by Sectigo. Mozilla independently recovered the private keys, suggesting a flawed generation process. Six of the compromised certificates were for TLS and trusted by multiple root programs, while two were for code-signing and trusted by Microsoft. eMudhra later marked the eight certificates as revoked on October 18th.

The swift distrust of eMudhra's intermediate certificates by Mozilla highlights a critical vulnerability in the certificate authority ecosystem. The fact that Mozilla could independently recover the private keys, bypassing eMudhra's own investigation, points to a fundamental flaw in their key generation or management processes. This incident underscores the ongoing challenges in ensuring the integrity and security of the root certificate infrastructure, which underpins a significant portion of internet security.

This event will likely lead to increased scrutiny of certificate authority practices and may prompt more proactive monitoring and faster distrust mechanisms across all major browser vendors. Organizations relying on eMudhra's certificates, particularly for TLS and code-signing, will need to assess their exposure and ensure a smooth transition to potentially new certificate providers to maintain user trust and operational continuity.