Post by @wdormann@infosec.exchange

That sound you hear is trust for some eMudhra emSign certs being revoked. (Private keys compromised)

https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/

https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/#CVE-2026-113470

Mozilla

Security Vulnerabilities fixed in Firefox 158.0.1

Mozilla Security Blog

Protecting Firefox users following the compromise of eMudhra intermediate certificates

On Saturday, October 17, at 20:06 UTC, Mozilla received a report that private keys associated with eight eMudhra intermediate certificates had been compromised. These keys could allow attackers to issue ...

0 Boosts

0 Likes

Will Dormann

@wdormann@infosec.exchange 46 min. ago

A company trusted with ensuring that the communications on the internet are secure, eMudhra, was tasked with using unguessable 384-bit private keys for a NIST P-384 elliptic curve.

eMudhra:
How about 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004? That's 384 bits, right?

On the upside, I guess this means that we'll be able to MITM devices that we wouldn't otherwise be able to see the traffic from. (Think non-computers like TVs and the like that'll never see updates)