FOSSWire
Search/
Distro Planets

Mozilla blocks compromised eMudhra certificates in Firefox within three hours

Brief written by the FOSSWire AI editor from Planet Mozilla How we write

1 min read

Key Takeaway

Mozilla blocked eight compromised eMudhra intermediate certificates in Firefox using OneCRL within three hours of receiving the report, and released patched browser versions for users with custom settings.

Summary

On October 17, private keys for eight eMudhra intermediate certificates were compromised, enabling potential fraudulent HTTPS certificate issuance. Mozilla blocked the affected certificates via OneCRL by 22:59 UTC the same day, protecting standard-configuration Firefox users without requiring updates or restarts. Firefox 158.0.1, ESR 115.43.1, and ESR 153.5.1 were released for users whose custom settings prevented OneCRL updates. NSS 3.131.1 was also updated to remove the signing root certificate, protecting other applications using Mozilla's trust store.

How Mozilla responded to the certificate compromise

  • OneCRL (One Certificate Revocation List) is Mozilla's centralized mechanism for pushing certificate revocations to Firefox users without requiring browser updates or restarts
  • Eight eMudhra intermediate certificates had their private keys compromised; these intermediates could sign fraudulent TLS certificates for arbitrary domains
  • The OneCRL update completed distribution to all standard-configuration Firefox users in under 3 hours (20:06 to 22:59 UTC)
  • Firefox 158.0.1 for Desktop and Android, plus ESR 115.43.1 and ESR 153.5.1, provide the same protection for users who disabled or blocked OneCRL updates
  • NSS 3.131.1 removes the root certificate that signed the affected intermediates, extending protection to non-Firefox applications using Mozilla's trust store

Why it matters

The incident demonstrates the value of centralized revocation mechanisms like OneCRL for rapid response to certificate compromises. The NSS update extends protection beyond Firefox to the broader ecosystem of applications relying on Mozilla's trust store, including many Linux distributions and open source tools.

What to do

  • If you use Firefox with standard settings, no action is needed; you were automatically protected by the OneCRL update on October 17.
  • If you use Firefox with custom settings that may block OneCRL updates, update to Firefox 158.0.1, Firefox ESR 115.43.1, or Firefox ESR 153.5.1.
  • If you use other applications that rely on Mozilla's trust store, ensure NSS is updated to version 3.131.1.

Original reference: blog.mozilla.org →