The private keys of eight intermediate certificate authorities (CA) from eMudhra were confirmed compromised by Mozilla and Google’s Chrome Root Program on October 20. This breach posed significant security risks, prompting immediate action from major web browsers.
The Impact of Compromised Keys
Intermediate CAs are responsible for signing certificates that websites use for secure connections. With these keys in the wrong hands, unauthorized certificates could be issued, deceiving browsers into trusting malicious websites. The compromise was reported on October 17, leading to swift blocks by both Chrome and Firefox.
Before the block, no Transport Layer Security (TLS) certificates linked to these compromised intermediates were logged in Certificate Transparency (CT), indicating that they were not trusted by default in browsers requiring CT logging. The details of the breach, such as how and when the keys were compromised, remain unclear.
Details of the Compromised Certificates
eMudhra, an Indian certificate authority, issues certificates under the emSign brand. The affected certificates include domain-validated, organization-validated, extended validation, and code-signing types. These certificates chain back to roots trusted by major browsers until the recent incident.
Immediate actions were taken to block the compromised certificates. Chrome’s TLS verifier doesn’t utilize paths restricted to code signing, hence did not need to block two code-signing certificates. Both Chrome and Mozilla implemented revocation lists to prevent the compromised certificates from being trusted.
Responses and Future Measures
Following the report, Chrome and Mozilla rapidly updated their systems to block the compromised certificates. This ensured that users remained protected without requiring immediate software updates or restarts. The researcher, known only as Wayne, played a crucial role in identifying and reporting the issue.
eMudhra has since revoked the affected certificates. Various software and trust stores, including Apple and Microsoft, were notified to ensure a comprehensive response. Meanwhile, Mozilla and Chrome continue to monitor the situation, assessing the potential need for further actions regarding eMudhra’s other roots.
Conclusion and Recommendations
For operators managing trust stores, it is crucial to block these compromised intermediates where possible. Software updates are necessary for systems that do not automatically check revocation data. The incident underscores the importance of robust security practices and timely responses to potential threats.
The eMudhra compromise highlights vulnerabilities in certificate management, urging continued vigilance from both certificate authorities and those managing internet security protocols. Further investigations are ongoing to determine the root cause and prevent similar incidents in the future.
