From 5ceb0f60510d7ad8bc1a69ad2427391910c26b31 Mon Sep 17 00:00:00 2001 From: Mark Karpeles Date: Wed, 21 Oct 2026 02:04:45 +0900 Subject: [PATCH] Disable emSign ECC Root CA - G3 after intermediate key compromise The private keys of eight eMudhra intermediate CAs chaining to emSign ECC Root CA - G3 were compromised (reported to the root programs 2026-10-17). Mozilla (NSS 3.131.1) and Chrome (Root Store v43) are removing the root. cacrt has no revocation channel, so per Mozilla's downstream guidance we distrust the root: rename it to *.disabled (kept for the audit trail) and record the rationale in CHANGELOG-roots.md and the eMudhra README. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG-roots.md | 25 +++++++++++++++++++ roots/eMudhra/README.md | 16 +++++++++--- ..._G3.pem => emSign_ECC_Root_CA_G3.disabled} | 0 3 files changed, 38 insertions(+), 3 deletions(-) rename roots/eMudhra/{emSign_ECC_Root_CA_G3.pem => emSign_ECC_Root_CA_G3.disabled} (100%) diff --git a/CHANGELOG-roots.md b/CHANGELOG-roots.md index 1846126..f71a572 100644 --- a/CHANGELOG-roots.md +++ b/CHANGELOG-roots.md @@ -34,3 +34,28 @@ no valid Buypass-issued TLS server certificate can exist in the wild and the roots serve no purpose as trust anchors. The certificate files and the company `README.md` (with full rationale and sources) are kept in `roots/Buypass/`. See . + +## 2026-10-21 — disabled emSign ECC Root CA - G3 (intermediate key compromise) + +Disabled **emSign ECC Root CA - G3** (eMudhra Technologies Limited, SHA-256 +`86A1ECBA089C4A8D3BBE2734C612BA341D813E043CF9E8A862CD5C57A36BBE6B`) by renaming +it to `*.disabled`. + +Rationale: on 2026-10-17 the private keys of eight eMudhra intermediate CA +certificates were reported to the root programs as compromised. The reporter +proved it by signing a test message with each key. These intermediates chain to +this root. Mozilla blocked them through OneCRL and is removing the root in +NSS 3.131.1. Chrome blocked them with a CRLSet and is removing the root in Chrome +Root Store version 43. Apple and Microsoft acted on 2026-10-19 and 2026-10-20. +`cacrt` has no revocation channel of its own, so we follow Mozilla's guidance for +downstream stores: distrust the root. + +The other roots named in the incident's `roots.json` are not in this store. Those +are `emSign Root TLS CA - G3` and `emSign Root CS CA - G3` (never in Mozilla), +plus Sectigo's `AAA Certificate Services` (removed from Mozilla earlier), which +cross-signed the affected keys. The other three eMudhra roots (G1, C1, C3) are +not named in the incident and stay trusted. + +- +- +- diff --git a/roots/eMudhra/README.md b/roots/eMudhra/README.md index e80b402..7254c11 100644 --- a/roots/eMudhra/README.md +++ b/roots/eMudhra/README.md @@ -1,5 +1,13 @@ # eMudhra +> **Status: emSign ECC Root CA - G3 DISABLED (removed from the compiled store as +> of 2026-10-21).** The private keys of eight eMudhra intermediate CAs chaining to +> this root were compromised (reported to the root programs 2026-10-17). Mozilla +> and Chrome are removing the root. The certificate is kept here as +> `emSign_ECC_Root_CA_G3.disabled`, which the build skips, to preserve the audit +> trail. G1, C1 and C3 are unaffected and remain trusted. See +> [`CHANGELOG-roots.md`](../../CHANGELOG-roots.md). + eMudhra is a digital identity and PKI services company headquartered in Bangalore, India, incorporated in 2008 and publicly listed on Indian exchanges since 2022. It operates two legal entities in the Web PKI: **eMudhra Technologies Limited** (India) and **eMudhra Inc** (USA), both issuing publicly trusted TLS certificates under the **emSign** brand. eMudhra is the first CA based in India to achieve inclusion in the major browser root programs globally. ## Roots in this folder @@ -7,7 +15,7 @@ eMudhra is a digital identity and PKI services company headquartered in Bangalor | Certificate | OpenSSL hash | Key | Valid until | SHA-256 fingerprint | |---|---|---|---|---| | emSign Root CA - G1 | `2923b3f9.0` | RSA 2048 | 2043-02-18 | `40:F6:AF:03:46:A9:9A:A1:CD:1D:55:5A:4E:9C:CE:62:C7:F9:63:46:03:EE:40:66:15:83:3D:C8:C8:D0:03:67` | -| emSign ECC Root CA - G3 | `14bc7599.0` | ECC P-384 | 2043-02-18 | `86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B` | +| emSign ECC Root CA - G3 *(disabled 2026-10-21)* | `14bc7599.0` | ECC P-384 | 2043-02-18 | `86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B` | | emSign Root CA - C1 | `406c9bb1.0` | RSA 2048 | 2043-02-18 | `12:56:09:AA:30:1D:A0:A2:49:B9:7A:82:39:CB:6A:34:21:6F:44:DC:AC:9F:39:54:B1:42:92:F2:E8:C8:60:8F` | | emSign ECC Root CA - C3 | `4b718d9b.0` | ECC P-384 | 2043-02-18 | `BC:4D:80:9B:15:18:9D:78:DB:3E:1D:8C:F4:F9:72:6A:79:5D:A1:64:3C:A5:F1:35:8E:1D:DB:0E:DC:0D:7E:B3` | @@ -29,7 +37,9 @@ eMudhra's certificates are logged to publicly operated Certificate Transparency ## Past non-compliance -No mis-issuance event resulting in distrust by any root program has been identified in public records. Three compliance incidents have been documented in Mozilla Bugzilla: +**Intermediate key compromise (October 2026):** The private keys of eight eMudhra intermediate CA certificates, chaining to emSign ECC Root CA - G3, were compromised. A reporter proved this to the root programs on 2026-10-17 by signing a test message with each key. Firefox and Chrome blocked the intermediates the same day, Apple on 2026-10-19 and Microsoft on 2026-10-20. Mozilla (NSS 3.131.1) and Chrome (Root Store v43) are removing the root. [[Mozilla Security Blog]](https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/) [[dev-security-policy thread]](https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ) + +Before this, three compliance incidents have been documented in Mozilla Bugzilla: 1. **OCSP Responder Time Inconsistency (Bug 1917459, September 2024):** An IST-to-UTC conversion error in the OCSP responder caused timestamps for certificates revoked between 12:00 and 23:59 IST to differ from CRL timestamps by 12 hours. The revocation *status* itself was correct in all cases; only the displayed timestamp was wrong. eMudhra identified the root cause within one day, deployed a fix within two days, and added enhanced monitoring and maker/checker controls. The bug was resolved fixed. [[Bug 1917459]](https://bugzilla.mozilla.org/show_bug.cgi?id=1917459) @@ -45,7 +55,7 @@ No other public incident records were found. For a live search of open Bugzilla - **CCADB:** eMudhra discloses root and intermediate CA certificates, audit statements, and CRL/OCSP URLs in CCADB as required by Mozilla and Microsoft root program policies. - **Audit statements:** WebTrust audit seals with CPA Canada verification links are published in the emSign repository; individual audit reports have been attached to Mozilla Bugzilla bugs during compliance reviews. - **Certificate Transparency:** Certificates issued under these roots are logged to public CT logs per CA/Browser Forum Baseline Requirements. -- **Incident reporting:** All three known incidents were disclosed via Mozilla Bugzilla with root-cause analysis and remediation timelines. +- **Incident reporting:** The three earlier compliance incidents were disclosed via Mozilla Bugzilla with root-cause analysis and remediation timelines. ## Sources diff --git a/roots/eMudhra/emSign_ECC_Root_CA_G3.pem b/roots/eMudhra/emSign_ECC_Root_CA_G3.disabled similarity index 100% rename from roots/eMudhra/emSign_ECC_Root_CA_G3.pem rename to roots/eMudhra/emSign_ECC_Root_CA_G3.disabled