Mozilla and Chrome Strip Trust for eMudhra Roots After Intermediate Compromise

Mozilla and Google Chrome have removed eMudhra root certificates from their respective trust programs following a compromise of intermediate certificates. Security teams must verify whether their environments rely on these roots and implement manual trust store adjustments if automatic revocation mechanisms are unavailable.

What happened

Dennis Jackson posted an advisory on the oss-security mailing list on October 20, detailing the compromise of eMudhra intermediate certificates. This notification was originally sent to the distros mailing list the previous day, according to the post. Mozilla subsequently published similar guidance on its security blog and the dev-sec-policy mailing list.

Valtteri Vuorikoski noted on October 20 that a test website is available to list mitigation options for systems that do not receive Certificate Revocation List updates. The recommended action involves disabling the "emSign ECC Root CA - G3" and "Comodo AAA Services root" in the operating system trust store. Vuorikoski warned that teams must be mindful of collateral damage when removing these roots.

Jeffrey Walton stated on October 20 that Chrome and Firefox have already removed the eMudhra root from their root programs. He expressed uncertainty about the status of Edge, Explorer, and other tooling that carries its own copy of a root store, such as cURL. Walton emphasized that teams should verify the trust status in these independent components.

Alan Coopersmith reported on October 20 that Mozilla removed restrictions on its tracking issue, making it publicly viewable. The issue is hosted on Bugzilla with the identifier 2083449. This transparency allows defenders to review the specific details of the compromise and the vendor's handling of the incident.

Why it matters

The removal of the Comodo AAA Services Root is not related to the eMudhra incident, according to Jeffrey Walton. The issue with the Comodo root stems from browsers removing the TLS trust bit because the root is too old. Current CA/Browser Baseline Requirements policies state that a root has a maximum lifespan of 15 years from its creation date.

The Comodo AAA Services Root was issued in 2004, which violates current policy, Walton explained. This distinction is critical for teams assessing the scope of required trust store changes. Disabling the Comodo root may have broader implications due to its past widespread use, separate from the security breach involving eMudhra intermediates.

Our take on the response

• Verify if your OS trust store includes emSign ECC Root CA - G3.
• Check independent tooling like cURL for embedded root certificates.
• Monitor for collateral damage when disabling widely used roots.
• Review Mozilla’s public Bugzilla issue 2083449 for details.

What defenders should look for

Teams usually detect certificate compromises by monitoring for unexpected certificate changes in web server configurations or client applications. Check whether internal systems are issuing or validating certificates against the compromised intermediates. Look for alerts indicating failed revocation checks or connections to servers using the affected roots. First containment moves involve isolating systems that cannot receive automatic revocation updates. Verify that all endpoints are enforcing strict certificate validation policies to prevent acceptance of unauthorized credentials.

What to do and how to stay safe: eMudhra

• Audit operating system trust stores for emSign ECC Root CA - G3 and Comodo AAA Services root.
• Verify that web browsers and tools like cURL are not using outdated, local root stores.
• Monitor logs for connections attempting to use certificates issued by the compromised intermediates.
• Once the vendor provides an update, ensure all systems receive the latest revocation data.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did Mozilla confirm a fix for the eMudhra compromise?

Mozilla and Chrome removed the eMudhra roots from their trust programs, but no software patch is mentioned in the source material.

Is the Comodo root removal related to the eMudhra hack?

No, the Comodo AAA Services Root removal is due to its age violating CA/Browser Baseline Requirements, not the eMudhra incident.

What should teams do if their systems do not get CRL updates?

Teams should disable the emSign ECC Root CA - G3 and Comodo AAA Services root in their operating system trust stores.