Disable emSign ECC Root CA - G3 (eMudhra intermediate key compromise)

CHANGELOG-roots.md

@@ -34,3 +34,28 @@ no valid Buypass-issued TLS server certificate can exist in the wild and the
 roots serve no purpose as trust anchors. The certificate files and the company
 `README.md` (with full rationale and sources) are kept in `roots/Buypass/`.
 See <https://www.buypass.com/products/tls-ssl-certificates/discontinues-issuance-of-tls-ssl-certificates>.
+
+## 2026-10-21 — disabled emSign ECC Root CA - G3 (intermediate key compromise)
+
+Disabled **emSign ECC Root CA - G3** (eMudhra Technologies Limited, SHA-256
+`86A1ECBA089C4A8D3BBE2734C612BA341D813E043CF9E8A862CD5C57A36BBE6B`) by renaming
+it to `*.disabled`.
+
+Rationale: on 2026-10-17 the private keys of eight eMudhra intermediate CA
+certificates were reported to the root programs as compromised. The reporter
+proved it by signing a test message with each key. These intermediates chain to
+this root. Mozilla blocked them through OneCRL and is removing the root in
+NSS 3.131.1. Chrome blocked them with a CRLSet and is removing the root in Chrome
+Root Store version 43. Apple and Microsoft acted on 2026-10-19 and 2026-10-20.
+`cacrt` has no revocation channel of its own, so we follow Mozilla's guidance for
+downstream stores: distrust the root.
+
+The other roots named in the incident's `roots.json` are not in this store. Those
+are `emSign Root TLS CA - G3` and `emSign Root CS CA - G3` (never in Mozilla),
+plus Sectigo's `AAA Certificate Services` (removed from Mozilla earlier), which
+cross-signed the affected keys. The other three eMudhra roots (G1, C1, C3) are
+not named in the incident and stay trusted.
+
+- <https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/>
+- <https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ>
+- <https://emudhra.we-have-a-problem.com/>

roots/eMudhra/README.md

@@ -1,13 +1,21 @@
 # eMudhra
 
+> **Status: emSign ECC Root CA - G3 DISABLED (removed from the compiled store as
+> of 2026-10-21).** The private keys of eight eMudhra intermediate CAs chaining to
+> this root were compromised (reported to the root programs 2026-10-17). Mozilla
+> and Chrome are removing the root. The certificate is kept here as
+> `emSign_ECC_Root_CA_G3.disabled`, which the build skips, to preserve the audit
+> trail. G1, C1 and C3 are unaffected and remain trusted. See
+> [`CHANGELOG-roots.md`](../../CHANGELOG-roots.md).
+
 eMudhra is a digital identity and PKI services company headquartered in Bangalore, India, incorporated in 2008 and publicly listed on Indian exchanges since 2022. It operates two legal entities in the Web PKI: **eMudhra Technologies Limited** (India) and **eMudhra Inc** (USA), both issuing publicly trusted TLS certificates under the **emSign** brand. eMudhra is the first CA based in India to achieve inclusion in the major browser root programs globally.
 
 ## Roots in this folder
 
 | Certificate | OpenSSL hash | Key | Valid until | SHA-256 fingerprint |
 |---|---|---|---|---|
 | emSign Root CA - G1 | `2923b3f9.0` | RSA 2048 | 2043-02-18 | `40:F6:AF:03:46:A9:9A:A1:CD:1D:55:5A:4E:9C:CE:62:C7:F9:63:46:03:EE:40:66:15:83:3D:C8:C8:D0:03:67` |
-| emSign ECC Root CA - G3 | `14bc7599.0` | ECC P-384 | 2043-02-18 | `86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B` |
+| emSign ECC Root CA - G3 *(disabled 2026-10-21)* | `14bc7599.0` | ECC P-384 | 2043-02-18 | `86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B` |
 | emSign Root CA - C1 | `406c9bb1.0` | RSA 2048 | 2043-02-18 | `12:56:09:AA:30:1D:A0:A2:49:B9:7A:82:39:CB:6A:34:21:6F:44:DC:AC:9F:39:54:B1:42:92:F2:E8:C8:60:8F` |
 | emSign ECC Root CA - C3 | `4b718d9b.0` | ECC P-384 | 2043-02-18 | `BC:4D:80:9B:15:18:9D:78:DB:3E:1D:8C:F4:F9:72:6A:79:5D:A1:64:3C:A5:F1:35:8E:1D:DB:0E:DC:0D:7E:B3` |
 
@@ -29,7 +37,9 @@ eMudhra's certificates are logged to publicly operated Certificate Transparency
 
 ## Past non-compliance
 
-No mis-issuance event resulting in distrust by any root program has been identified in public records. Three compliance incidents have been documented in Mozilla Bugzilla:
+**Intermediate key compromise (October 2026):** The private keys of eight eMudhra intermediate CA certificates, chaining to emSign ECC Root CA - G3, were compromised. A reporter proved this to the root programs on 2026-10-17 by signing a test message with each key. Firefox and Chrome blocked the intermediates the same day, Apple on 2026-10-19 and Microsoft on 2026-10-20. Mozilla (NSS 3.131.1) and Chrome (Root Store v43) are removing the root. [[Mozilla Security Blog]](https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/) [[dev-security-policy thread]](https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ)
+
+Before this, three compliance incidents have been documented in Mozilla Bugzilla:
 
 1. **OCSP Responder Time Inconsistency (Bug 1917459, September 2024):** An IST-to-UTC conversion error in the OCSP responder caused timestamps for certificates revoked between 12:00 and 23:59 IST to differ from CRL timestamps by 12 hours. The revocation *status* itself was correct in all cases; only the displayed timestamp was wrong. eMudhra identified the root cause within one day, deployed a fix within two days, and added enhanced monitoring and maker/checker controls. The bug was resolved fixed. [[Bug 1917459]](https://bugzilla.mozilla.org/show_bug.cgi?id=1917459)
 
@@ -45,7 +55,7 @@ No other public incident records were found. For a live search of open Bugzilla
 - **CCADB:** eMudhra discloses root and intermediate CA certificates, audit statements, and CRL/OCSP URLs in CCADB as required by Mozilla and Microsoft root program policies.
 - **Audit statements:** WebTrust audit seals with CPA Canada verification links are published in the emSign repository; individual audit reports have been attached to Mozilla Bugzilla bugs during compliance reviews.
 - **Certificate Transparency:** Certificates issued under these roots are logged to public CT logs per CA/Browser Forum Baseline Requirements.
-- **Incident reporting:** All three known incidents were disclosed via Mozilla Bugzilla with root-cause analysis and remediation timelines.
+- **Incident reporting:** The three earlier compliance incidents were disclosed via Mozilla Bugzilla with root-cause analysis and remediation timelines.
 
 ## Sources