eMudhra intermediate CA compromise

Date:
Tue, 20 Oct 2026 14:56:23 +0000

Description:
Mozilla has announced that it has received a report that private keys associated with eight eMudhra intermediate certificates have
been compromised: These keys could allow attackers to issue fraudulent HTTPS certificates for
websites they do not control. An attacker who could intercept a user's connection could use those certificates to impersonate websites and potentially
read or modify traffic. Mozilla has blocked the affected certificates using its OneCRL centralized list of revoked certificates, and has updated the trusted
certificate list in Network
Security Services (NSS) 3.131.1 . There is a single-page
site about the compromise that goes into more detail. According to the site
the certificates have also been blocked in Chrome since October17, Apple devices since the 19th, and Microsoft blocked the certificates on the
20th. There is also a table that displays whether a browser or other client still trusts the compromised certificates. The NetBSD foundation has issued instructions to block the certificates on NetBSD installations. Users of
other browsers and operating systems may wish to check for updates or guidance to disable the compromised certificates.

======================================================================
Link to news story:
https://lwn.net/Articles/1101643/


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet UK HUB @ hub.uk.erb.pw (1337:1/100)