Google, Mozilla, Apple and Go Block Certificates Linked to Eight Compromised eMudhra Keys
Summary
Google, Mozilla, Apple and Go blocked certificates tied to eight compromised eMudhra intermediate keys. Whether attackers used the keys to issue fraudulent certificates is unknown; some applications require software updates to stop trusting them.
Key points
- Six compromised intermediate keys were used for TLS certificates and two for code-signing certificates.
- The blocks aim to prevent fraudulent certificates from being trusted and used to impersonate websites or services.
- Mozilla, Google and Apple distributed blocks through certificate-revocation mechanisms; Go applications need patched versions to receive the fix.
- Go maintainers recommended upgrading to versions 1.27.3 or 1.26.10.
- Mozilla said it learned of the compromise on Oct. 17 from a researcher who demonstrated access to all eight private keys.
- It remains unclear how or when the compromise occurred, or whether attackers used the keys to issue fraudulent certificates.
- Mozilla and Google said their reviews found no evidence of other affected CAs or certificates with the same failure mode.
Article Details
- Event Type
- Compromise of eight eMudhra intermediate certificate authority keys, followed by certificate trust blocks.
- Impact
- The compromised keys could have been used to issue fraudulent TLS or code-signing certificates, enabling website or service impersonation and potentially interception of encrypted communications. Google, Mozilla, Apple, and the Go project blocked trust in affected certificates. Whether attackers used the keys to issue fraudulent certificates was unclear; Mozilla reported no evidence that other CAs were similarly affected. Some applications require software updates to receive the protections.
People
Vendors
AppleGoogle, Mozilla, Apple, and the Go programming language project blocked certificates signed with eight compromised certificate authority (CA) keys in a widening response to an incident that could allow attackers toeMudhraThe affected keys were associated with intermediate certificates issued by Indian CA eMudhra. Six were used to issue TLS certificates for websites while the other two were used for code signing.GoogleGoogle, Mozilla, Apple, and the Go programming language project blocked certificates signed with eight compromised certificate authority (CA) keys in a widening response to an incident that could allow attackers toMicrosofthaving revoked the compromised intermediate certificates. "This has already been remediated by Mozilla, Microsoft, Apple, and Chrome for their users through their tools for distributing revocation information such asMozillaGoogle, Mozilla, Apple, and the Go programming language project blocked certificates signed with eight compromised certificate authority (CA) keys in a widening response to an incident that could allow attackers to
Products
CRLiteand Chrome for their users through their tools for distributing revocation information such as OneCRL, CRLite and CRLSets," he wrote. "However, many other clients do not consume revocation information and requireCRLSetsfor their users through their tools for distributing revocation information such as OneCRL, CRLite and CRLSets," he wrote. "However, many other clients do not consume revocation information and require softwareGoGoogle, Mozilla, Apple, and the Go programming language project blocked certificates signed with eight compromised certificate authority (CA) keys in a widening response to an incident that could allow attackers toGoogle ChromeTransparency protections would have prevented affected TLS certificates from being trusted by default in Chrome before the blocks took effect.Mozilla FirefoxMozilla, meanwhile, said users with standard Firefox configurations received its block without needing to update or restart the browser.OneCRLApple, and Chrome for their users through their tools for distributing revocation information such as OneCRL, CRLite and CRLSets," he wrote. "However, many other clients do not consume revocation information and