Mitigation posted for the eMudhra intermediate CA compromise
Original title: Re: eMudhra Intermediates Compromise
Systems that do not receive CRL updates are told to disable emSign ECC Root CA - G3 and the Comodo AAA Services root.
An October 20 oss-security reply points to a test website listing mitigations for the eMudhra intermediates compromise. For systems that do not receive CRL or equivalent revocation updates, it says to disable the roots "emSign ECC Root CA - G3" and "Comodo AAA Services root" in the operating-system trust store. It warns of collateral damage, noting the Comodo root has been widely used.
Unconfirmed: The post does not say whether the keys were used to issue certificates.
- The suggested action is disabling two named roots in the OS trust store.
- The Comodo AAA Services root is flagged for possible collateral damage.
- A test website is said to list the mitigation options.
Impact: Trust of compromised eMudhra intermediate CA keys
| Product | Affected |
|---|---|
| eMudhra emSign ECC Root CA - G3 | — |
| Comodo AAA Services root | — |
- 1.Disable emSign ECC Root CA - G3 and the Comodo AAA Services root where revocation updates are not received.
- 2.Check for collateral breakage from distrusting the widely used Comodo root.
From the original article
Posted by Valtteri Vuorikoski on Oct 20 A test website is available at which also lists mitigation options for systems which do not receive CRL or equivalent revocation updates. Effectively: disable the root CAs "emSign ECC Root CA - G3" and "Comodo AAA Services root" in your operating system trust store, while being mindful of collateral damage. The Comodo root in particular has been widely used in the past.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.