eMudhra ignored Mozilla Root investigation deadline; blames social media

What happened

In October, Mozilla got a report that the private keys for 8 eMudhra intermediate certificates had been compromised. A private key is a secret code that proves a certificate is real. If someone else has it, they can pretend to be a trusted website or software maker. Mozilla checked the report, then removed these certificates from Firefox using a tool called OneCRL. Mozilla also found that it could recover the private keys on its own, which showed the key generation process was flawed and easy to exploit.

Key facts

• 8 intermediate certificates had their private keys compromised.
• 6 of them are for TLS (the security used by websites) and are trusted by Chrome, Mozilla, Microsoft and Apple.
• 2 of them are for code signing (checking that software is from a real source) and are trusted by Microsoft.
• Mozilla removed the certificates from Firefox in one process that finished at 22:59 UTC.

Background

Certificate authorities issue the digital IDs that keep websites and software safe. Intermediate certificates sit between the main root certificate and the certificates given to users. Browser makers such as Mozilla keep lists of trusted authorities. When a problem appears, they can remove trust. Here, Sectigo was also told because it had cross-signed some of the affected certificates.

Why it matters

When private keys leak, attackers can make fake websites or fake software that looks safe to users. This story also shows a problem with trust. Mozilla says eMudhra ignored its investigation deadline and blamed social media. Browser makers need certificate authorities to act quickly and be open, so that users stay protected.

What to watch

• Whether eMudhra answers Mozilla's questions in the new PDF file.
• Whether Mozilla or other browser makers take further action against eMudhra.
• Whether eMudhra and Sectigo replace the affected certificates.