The private keys of eight eMudhra intermediate CA certificates have been compromised. The certificates chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores. The original reporter, Wayne, demonstrated the compromise by signing a message with the private key of each of the eight intermediate CAs and reporting it to the Root Program Teams on October 17th. The package includes the message, certificates, public keys and signatures so that anyone can verify the signatures using OpenSSL.
The root programs and many downstream trust stores have taken action. The certificates have been blocked in Firefox and Chrome since October 17th, in Apple devices since October 19th, and in Microsoft since October 20th. The issue was responsibly disclosed to downstream trust stores on October 19th, and many have released or are preparing updates. The CA has also revoked the compromised intermediate certificates.
An attacker holding any of the compromised private keys could impersonate any website or service. Mozilla, Microsoft, Apple and Chrome have remediated this for their users through revocation tools such as CRLite and CRLSets. However, many other clients do not consume revocation information and require software updates to stop trusting the compromised intermediates. Users are advised to update browsers and operating systems to the latest versions as soon as possible.
Patched versions are available for several developer tools and packages, including Go, Electron, Python certifi, Rust webpki-roots, Homebrew ca-certificates and NSS, while some, such as Node.js and Composer, were still pending at the time of reporting. Expert Linux users can manually distrust the affected roots in the system trust store until distributions ship updated ca-certificates packages, but this is not recommended for ordinary users.
Source: Hacker News · Summarized by HeadlinesBriefing