eMudhra ignored Mozilla Root investigation deadline; blames social media

Open Bug 2083449 Opened 6 days ago Updated 11 minutes ago CA Program CA Certificate Compliance defect P1

ASSIGNED emudhra-attestation.zip 6 days ago 14.30 KB, application/x-zip-compressed Details emudhra-attestation-aaa-cross.zip 6 days ago Wayne 12.68 KB, application/x-zip-compressed Details emudhra-g1-crl-signature.zip 6 days ago Wayne 5.07 KB, application/x-zip-compressed Details Issuer_HSM_Mapping.xlsx 5 days ago Naveen Kumar ML 10.11 KB, application/vnd.openxmlformats-officedocument.spreadsheetml.sheet Details disclosure 5 days ago Dennis Jackson 6.99 KB, text/plain Details proof of key compromise but no revocation in oneCRL 4 days ago Knight 2.94 KB, text/plain Details eMudhra-questions.pdf 1 day ago Dennis Jackson 148.71 KB, application/pdf Details Original Reporter: rdaurne77@gmail.com (Wayne) On 17th October @ 20:06 UTC, Mozilla received a report to certificates@mozilla.org, forwarded by the Chrome Root program, from Wayne, that the private key of 8 eMudhra Intermediate certificates have been compromised. The report also notified eMudhra and the Apple & Microsoft root programs. The report included a proof of key control for all 8 certificates. Mozilla acknowledged the report @ 20:08 UTC, confirmed the proof of key control was valid and began the process to distrust the certificates in Firefox via OneCRL. This process was tracked in Bug 2083382 and completed @ 22:59 UTC. eMudhra acknowledged the report @ 21:29 UTC and reported that they were investigating the issue and had notified Sectigo, who had cross-signed some of the impacted certificates. Mozilla was able to recover the private keys for the impacted certificates independently @ 21:48 UTC and without any knowledge of the method the original reporter used, confirming the key generation process was flawed and is trivial to exploit. 6 of the impacted certificates are for TLS and trusted by the Chrome, Mozilla, Microsoft and Apple root programs. The other two certificates are for codesigning and trusted by Microsoft: EM EV TLS CA - G3B (eMudhra BV), CCADB A012304 SHA-256 E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838 serial c7c41efe92d825f05eae841a4a82c1, issuer emSign Root TLS CA - G3 EM OV TLS CA - G3B (eMudhra BV), CCADB A012308 SHA-256 98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B serial 6cada367fb1c100088120ea202d568, issuer emSign Root TLS CA - G3 EM DV TLS CA - G3B (eMudhra BV), CCADB A012302 SHA-256 …