Post by @netbsd@mastodon.sdf.org

Hello, please immediately run the following commands on your #NetBSD installations:

# certctl untrust /usr/share/certs/mozilla/all/emSign_Root_CA_-_C1.pem
# certctl untrust /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_C3.pem

Context: https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ

Compromised eMudhra Intermediate Certificates

#netbsd

1 Boost

0 Likes

redsakana

@redsakana@infosec.exchange 38 min. ago

@netbsd
According to the circulating mailing list post, the affected roots are G3, not C3 or C1

edit: also Comodo AAA Services Root needs to be removed. This may have more blast radius than emSign in some circumstances, though this (ancient) CA seems to be already gone from some root programs

Clemens

@neverpanic@chaos.social 18 min. ago

@redsakana @netbsd While that is correct, the CA itself has asked to remove the C3 and C1 root from Mozilla's trust store, though: https://bugzilla.mozilla.org/show_bug.cgi?id=2083709

So I guess removing that as well isn't a bad idea.

2083709 - Remove eMudhra emSign Root CA - C1 and emSign ECC Root CA - C3 from NSS

RESOLVED (anna.weine) in CA Program - CA Certificate Root Program. Last updated 2026-10-20.