eMudhra, a certificate authority, has been accused of ignoring a Mozilla root investigation deadline and of blaming social media for the fallout. The dispute centers on Bugzilla Bug 2083449, which was opened five days ago under the CA Certificate Compliance component and remains active.
The case began on 17 October, when Mozilla received a report via certificates@mozilla.org, forwarded by the Chrome Root program, from a reporter identified as Wayne. The report claimed that the private keys of 8 eMudhra intermediate certificates had been compromised and included proof of key control for all eight. Mozilla confirmed the proof was valid and moved to distrust the certificates in Firefox through OneCRL, completing that step at 22:59 UTC. eMudhra acknowledged the report later that evening and said it had notified Sectigo, which had cross-signed some of the affected certificates. Mozilla independently recovered the private keys, showing that the key generation process was flawed and trivial to exploit.
Six of the impacted certificates are TLS certificates trusted by the Chrome, Mozilla, Microsoft and Apple root programs. The remaining two are code-signing certificates trusted by Microsoft. On 18 October, eMudhra marked the eight certificates as revoked for reason "CA Compromise."
The attached materials, including attestation files, a CRL signature file, an HSM mapping spreadsheet and a PDF of questions, show the investigation is ongoing, with the most recent update posted just 37 minutes ago.
Source: Hacker News · Summarized by HeadlinesBriefing