Eight eMudhra Certificate Authority Keys Compromised, Prompting Emergency Blocks in Chrome, Firefox and Go

Mozilla and Google's Chrome Root Program confirmed on October 20 that the private keys of eight intermediate certificate authority (CA) certificates belonging to eMudhra, an Indian CA that sells certificates under the emSign brand, have been compromised. An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website that a browser would accept.

A researcher reported the problem on the evening of October 17. Chrome verified the findings, and both Chrome and Firefox blocked the eight certificates within hours. Chrome had an update blocking the six website (TLS) intermediates in place by 19:45 UTC, about 100 minutes after receiving the report. Chrome said no TLS certificate chaining to those six had been logged to Certificate Transparency before the block, so none could have been trusted by default in Chrome or any other browser that requires such logging. It did not need to block the two code-signing certificates, because its verifier will not build a path through an intermediate restricted to code signing. The Go programming language also blocked the keys in its October 20 security releases, using its URGENT track.

Important questions remain open. It is not known how the keys left eMudhra, when this happened, or whether anyone besides the researcher holds them. eMudhra has roots in the Mozilla, Chrome and Apple root stores, and the six TLS certificates chain to a root that Mozilla's store included until October 20.