eMudhra intermediate CA compromise

Mozilla has announcedthat it has received a report that private keys associated with eight eMudhra intermediate certificates havebeen compromised:

These keys could allow attackers to issue fraudulent HTTPS certificates forwebsites they do not control. An attacker who could intercept a user'sconnection could use those certificates to impersonate websites and potentiallyread or modify traffic.

Mozilla has blocked the affected certificates using its OneCRLcentralized list of revoked certificates, and has updated the trustedcertificate list in NetworkSecurity Services (NSS) 3.131.1.

There is a single-pagesite about the compromise that goes into more detail. According to the sitethe certificates have also been blocked in Chrome since October17, Appledevices since the 19th, and Microsoft blocked the certificates on the20th. There is also a table that displays whether a browser or other clientstill trusts the compromised certificates.

The NetBSD foundation has issuedinstructions to block the certificates on NetBSD installations. Users ofother browsers and operating systems may wish to check for updates or guidanceto disable the compromised certificates.