EMudhra Intermediate CA Compromise

sed -i
-e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|'
-e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|'
/etc/ca-certificates.conf && update-ca-certificates

On Alpine, run as root:

apk add ca-certificates && sed -i -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|'
/etc/ca-certificates.conf && update-ca-certificates

On Fedora, RHEL, CentOS Stream, Rocky Linux, AlmaLinux and Amazon Linux 2023, run as root:

d=/etc/pki/ca-trust/source/blocklist; [ -d $d ] || d=/etc/pki/ca-trust/source/blacklist trust extract --overwrite --format=pem-bundle
--filter='pkcs11:object=Comodo%20AAA%20Services%20root;type=cert'
$d/Comodo_AAA_Services_root.pem && trust extract --overwrite --format=pem-bundle
--filter='pkcs11:object=emSign%20ECC%20Root%20CA%20-%20G3;type=cert'
$d/emSign_ECC_Root_CA_-_G3.pem && update-ca-trust

On openSUSE and SLES, run as root:

d=/etc/pki/trust/blocklist; [ -d $d ] || d=/etc/pki/trust/blacklist trust extract --format=pem-bundle
--filter='pkcs11:object=Comodo%20AAA%20Services%20root;type=cert'
$d/Comodo_AAA_Services_root.pem && trust extract --format=pem-bundle
--filter='pkcs11:object=emSign%20ECC%20Root%20CA%20-%20G3;type=cert'
$d/emSign_ECC_Root_CA_-_G3.pem && update-ca-certificates

On Arch Linux, run as root:

trust extract --format=pem-bundle
--filter='pkcs11:object=emSign%20ECC%20Root%20CA%20-%20G3;type=cert'
/etc/ca-certificates/trust-source/blocklist/emSign_ECC_Root_CA_-_G3.pem && update-ca-trust

On NixOS, add to your configuration:

security.pki.caCertificateBlacklist = [ "Comodo AAA Services root" "emSign ECC Root CA - G3" "emSign Root CA - C1" "emSign ECC Root CA - C3" ];

What actions can trust store operators take?

Please see this thread in Mozilla's dev-security-policy forum.

impacted-intermediates.json lists the eight intermediates and their Sectigo cross-signs. roots.json lists the roots they chain to.

Site published by Dennis Jackson. The source is on GitHub and PRs are welcome.