Tech Giants Revoke eMudhra Digital Certificates Following Intermediate CA Key Leak.

Major Root Stores Revoke eMudhra Certificates Following Intermediate CA Private Key Leak

Major technology vendors including Apple, Google, Microsoft, Mozilla, and Canonical have swiftly moved to revoke trust in intermediate Certificate Authority (CA) certificates issued by Indian identity and digital signature provider eMudhra. The emergency ecosystem-wide revocation was triggered after a security researcher publicly proved the compromise of eight eMudhra intermediate CA private keys by producing valid cryptographic signatures generated directly by those secret keys.

Compromise Mechanics, Rapid Revocation, and Certificate Transparency Protections

• Private Key Compromise and Cryptographic Verification:

  • Proof of Leak: An unidentified security researcher disclosed the leak by signing messages using eight distinct private keys belonging to eMudhra intermediate CAs. Six of these keys governed Domain, Organization, and Extended Validation (DV, OV, EV) Transport Layer Security (TLS) certificates, while two governed code-signing operations.

  • Sectigo Cross-Signing Exposure: The affected eMudhra intermediate certificates were cross-signed by Sectigo (formerly Comodo CA) under legacy trust-anchoring arrangements. Because a simple block of eMudhra’s root certificates would leave Sectigo-signed paths active, vendors had to block the underlying public key hashes directly across their global trust stores.

• Rapid Ecosystem Response and Root Store Removal:

  • Instant Automated Revocation: Browser vendors deployed rapid, out-of-band updates using dynamic revocation lists such as Chrome’s CRLSets and Firefox’s OneCRL allowing millions of client endpoints to block the compromised keys without requiring a full browser software restart.

  • Full Root Store Removal: Following initial emergency blocks, the Chrome Root Program, Mozilla, and Apple initiated full trust removal for eMudhra's primary root authorities (including the emSign ECC Root CA - G3), effectively severing eMudhra’s ability to issue globally trusted web certificates going forward.

• Mitigating Risk via Certificate Transparency (CT) Monitoring:

  • Zero Unlogged Exploits: Security teams operating the Chrome Root Program confirmed that public Certificate Transparency (CT) logs revealed no unauthorized or fraudulent TLS certificates generated using the leaked keys prior to the revocation window.

  • Mandatory CT Enforcement: Modern web browsers automatically reject any public TLS certificate that fails to register in publicly auditable CT logs. Even if rogue entities attempted to issue unauthorized certificates using the leaked keys, CT enforcement prevented those forged certificates from successfully establishing encrypted HTTPS connections on user devices.

 

Source: dev-security-policy 

💬 AI Content Assistant

Ask me anything about this article. No data is stored for your question.

Major Root Stores Revoke eMudhra Certificates Following Intermediate CA Private Key Leak

Major technology vendors including Apple, Google, Microsoft, Mozilla, and Canonical have swiftly moved to revoke trust in intermediate Certificate Authority (CA) certificates issued by Indian identity and digital signature provider eMudhra. The emergency ecosystem-wide revocation was triggered after a security researcher publicly proved the compromise of eight eMudhra intermediate CA private keys by producing valid cryptographic signatures generated directly by those secret keys.

Compromise Mechanics, Rapid Revocation, and Certificate Transparency Protections

• Private Key Compromise and Cryptographic Verification:

  • Proof of Leak: An unidentified security researcher disclosed the leak by signing messages using eight distinct private keys belonging to eMudhra intermediate CAs. Six of these keys governed Domain, Organization, and Extended Validation (DV, OV, EV) Transport Layer Security (TLS) certificates, while two governed code-signing operations.

  • Sectigo Cross-Signing Exposure: The affected eMudhra intermediate certificates were cross-signed by Sectigo (formerly Comodo CA) under legacy trust-anchoring arrangements. Because a simple block of eMudhra’s root certificates would leave Sectigo-signed paths active, vendors had to block the underlying public key hashes directly across their global trust stores.

• Rapid Ecosystem Response and Root Store Removal:

  • Instant Automated Revocation: Browser vendors deployed rapid, out-of-band updates using dynamic revocation lists such as Chrome’s CRLSets and Firefox’s OneCRL allowing millions of client endpoints to block the compromised keys without requiring a full browser software restart.

  • Full Root Store Removal: Following initial emergency blocks, the Chrome Root Program, Mozilla, and Apple initiated full trust removal for eMudhra's primary root authorities (including the emSign ECC Root CA - G3), effectively severing eMudhra’s ability to issue globally trusted web certificates going forward.

• Mitigating Risk via Certificate Transparency (CT) Monitoring:

  • Zero Unlogged Exploits: Security teams operating the Chrome Root Program confirmed that public Certificate Transparency (CT) logs revealed no unauthorized or fraudulent TLS certificates generated using the leaked keys prior to the revocation window.

  • Mandatory CT Enforcement: Modern web browsers automatically reject any public TLS certificate that fails to register in publicly auditable CT logs. Even if rogue entities attempted to issue unauthorized certificates using the leaked keys, CT enforcement prevented those forged certificates from successfully establishing encrypted HTTPS connections on user devices.

 

Source: dev-security-policy