Mozilla, Chrome Block Eight eMudhra Certificates After Researcher Finds Compromised Keys
Major browser vendors blocked eight intermediate certificates from Indian CA eMudhra after a researcher demonstrated control over their private keys, raising trust concerns.
Key points
- Mozilla and Google confirmed the compromise of eight eMudhra intermediate CA keys on October 20, leading to immediate blocking actions.
- A researcher reported the vulnerability on October 17, prompting Chrome and Firefox to block the certificates within hours of verification.
- No TLS certificates chained to these intermediates had been logged in Certificate Transparency logs prior to the block, limiting immediate exposure.
Mozilla and the Google Chrome Root Program confirmed on October 20 that the private keys for eight intermediate certificate authority certificates issued by eMudhra were compromised. This discovery triggered emergency blocking measures across major web browsers and software platforms. The incident follows a report from a security researcher who demonstrated control over these keys, raising significant concerns about the integrity of SSL trust chains.
The researcher submitted the findings to the root programs on the evening of October 17. Chrome and Firefox moved to block the eight certificates within hours after Chrome verified the validity of the claims. According to the Chrome Root Program, no TLS certificates chaining to the six TLS intermediates had been recorded in Certificate Transparency logs before the block. This means none of these certificates could have been trusted by default in Chrome or other browsers requiring CT logging.
Technical Context and Response
The compromised keys correspond to those blocked by Go in its October 20 security releases, as reported by The Hacker News. The eight hash values found in Go’s code match the affected eMudhra certificates exactly. Go processed this fix on its URGENT track, a policy reserved for threats to ecosystem integrity or wild exploitation. However, the release notes did not specify which condition applied. It remains unknown how the keys left eMudhra, when the exfiltration occurred, or if any other parties possess them besides the reporting researcher.
eMudhra, an Indian certificate authority operating under the emSign brand, has roots in the Mozilla, Chrome, and Apple root stores. The eight compromised certificates include domain validated, organization validated, extended validation, and code signing variants. Specifically, the list includes EM DV TLS CA - G3B and G3C, EM OV TLS CA - G3B and G3C, EM EV TLS CA - G3B and G3C, and EM OV CS CA - G3B and G3C. As Threat Times reported on October 20, major tech firms blocked these certificates after the researcher proved key compromise, highlighting the fragility of certificate trust.
Affected Systems and Certificates
The six TLS certificates were issued by emSign Root TLS CA - G3 and chain to emSign ECC Root CA - G3. This root is present in the Chrome and Apple stores and was in Mozilla’s store until October 20. Each of the eight compromised certificates also exists as a second certificate with the same public key, cross-signed by Sectigo under its AAA Certificate Services root, according to a list published by Mozilla cryptography engineer Dennis Jackson. Chrome did not need to block the two code-signing certificates because its TLS verifier does not build paths through intermediates restricted to code signing.
What should you do?
Security teams should verify that their internal systems and browsers are updated to the latest versions that reflect these blocking actions. Organizations relying on eMudhra or emSign certificates should audit their certificate chains to ensure they are not using the compromised intermediates. Monitoring Certificate Transparency logs can help detect any new, unexpected issuances linked to these keys.
What to do and how to stay safe: eMudhra
- Update all browsers and TLS libraries to the latest versions to ensure the compromised certificates are blocked.
- Audit your organization's certificate inventory to identify any dependencies on eMudhra or emSign intermediate CAs.
- Monitor Certificate Transparency logs for any anomalous certificate issuances linked to the affected keys.
- Review internal security policies to ensure rapid response capabilities for similar CA compromise events.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why were the eMudhra certificates blocked?
Mozilla and Google blocked the certificates because a researcher demonstrated control over the private keys of eight intermediate CAs.
Were any websites affected by this compromise?
According to the Chrome Root Program, no TLS certificates chaining to the intermediates were logged in Certificate Transparency before the block.
How can I check if my system is protected?
Ensure your browsers and TLS libraries are updated to the latest versions that include the blocking measures for these certificates.
