NSS 3.131.1 drops emSign certs amid eMudhra questions
Original title: Re: eMudhra Intermediates Compromise
Solar Designer asks whether another certificate still cross-signs the compromised intermediates.
On an oss-security thread about the eMudhra intermediates compromise, Solar Designer questions whether a remaining certificate cross-signs the compromised intermediates. He notes NSS 3.131.1 removes the emSign certificates but has not yet removed the other certificate, and asks whether that omission needs an urgent further update.
Unconfirmed: Whether the remaining certificate cross-signs the compromised intermediates, and whether removal is urgent, is posed as a question.
- The post is dated October 20.
- NSS 3.131.1 is said to remove the emSign certificates.
- The other certificate is described as not yet removed.
Impact: Possible continued trust in compromised certificate intermediates
| Product | Affected |
|---|---|
| NSS | 3.131.1 |
From the original article
Posted by Solar Designer on Oct 20 Are you sure? Doesn't it cross-sign the compromised intermediates? This may be right, but perhaps the urgency to remove it now is related to the eMudhra incident?
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.