Mozilla has warned about the compromise of private keys associated with eight intermediate (secondary) root certificates from the eMudhra Certificate Authority. The compromised keys allowed for the issuance of fake TLS certificates for any site, perceived as trustworthy in all browsers, which could be used to intercept or modify transit traffic.
The private keys were reconstructed by researchers from publicly available data, made possible due to an error in the key generation process based on the P-384 elliptic curve. The error resulted in the keys being generated using initialization with integers less than 256 instead of cryptographically secure random numbers, meaning the private key size was 1 byte instead of the required 48 bytes. With such generation, the private key could be reconstructed using the discrete logarithm algorithm or through simple brute force by generating the first 256 possible keys. As the values of the private keys are now known (4, 56, 66, 115, 155, 156, 230, and 237), all users are strongly advised to promptly update their browsers and root certificate packages.
As proof of the private key leak, the researcher who reported the incident published a message signed with the private keys from each of the eight compromised eMudhra certificates. You can check your browser for updates on revoked certificates on the incident-specific website.
Emergency corrective releases for Firefox versions 158.0.1, 115.43.1, and 153.5.1 have been formed, as well as the NSS library 3.131.1, in which the root certificate store has been updated and problematic certificates have been blocked. In Chrome and Google products, the compromised certificates were blocked on October 17, in Apple on October 19, and in Microsoft on October 20. The block was also implemented through centralized revocation lists: OneCRL, CRLite, and CRLSets.
Updated root certificate packages have been released for Ubuntu (ca-certificates 20260816ubuntu0.2*.04.1), Debian (ca-certificates 20250419+deb13u1), Arch Linux (ca-certificates-mozilla 3.131.1-1), Gentoo (ca-certificates 20260816.3.125), curl, Homebrew, Go (1.27.3, 1.26.10), Python, RustTLS, Electron, and Elixir. The root certificate lists in FreeBSD, Node.js, Bun, and Composer remain unrevised.
Before updating the ca-certificates package for manually removing problematic root certificates in Debian and Ubuntu, you can use the command:
sed -i \
-e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
-e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
/etc/ca-certificates.conf && update-ca-certificates
On Fedora, RHEL, CentOS Stream, Rocky Linux, AlmaLinux, and Amazon Linux 2023:
d=/etc/pki/ca-trust/source/blocklist; [ -d $d ] || d=/etc/pki/ca-trust/source/blacklist
trust extract --overwrite --format=pem-bundle \
--filter='pkcs11:object=ComodoAAAServicesroot;type=cert' \
$d/Comodo_AAA_Services_root.pem &&
trust extract --overwrite --format=pem-bundle \
--filter='pkcs11:object=emSignECCRootCA-G3;type=cert' \
$d/emSign_ECC_Root_CA_-_G3.pem &&
update-ca-trust
On openSUSE and SLES:
d=/etc/pki/trust/blocklist; [ -d $d ] || d=/etc/pki/trust/blacklist
trust extract --format=pem-bundle \
--filter='pkcs11:object=ComodoAAAServicesroot;type=cert' \
$d/Comodo_AAA_Services_root.pem &&
trust extract --format=pem-bundle \
--filter='pkcs11:object=emSignECCRootCA-G3;type=cert' \
$d/emSign_ECC_Root_CA_-_G3.pem &&
update-ca-certificates
On NixOS:
security.pki.caCertificateBlacklist = [
"Comodo AAA Services root"
"emSign ECC Root CA - G3"
];
On NetBSD:
certctl untrust /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_G3.pem &&
certctl untrust /usr/share/certs/mozilla/all/Comodo_AAA_Services_root.pem
Source: opennet.ru
