Private keys for eight eMudhra intermediate Certificate Authority (CA) certificates have been compromised, making it trivial for attackers to forge certificates that would be trusted by unpatched roots of trust. Six of the impacted certificates were for Transport Layer Security (TLS) and trusted by the Apple, Chrome, Microsoft and Mozilla root programs. The other two certificates were for codesigning and trusted by Microsoft. Browsers were able to block the affected intermediate CAs using their background revocation blocklists, but most other software relying on web public key infrastructure (PKI) lacks any mechanism to filter intermediate CAs. In order to defend against rogue certificates from the compromised intermediate CAs many projects have chosen to remove the emSign ECC Root CA – G3 from their roots of trust. That removal is causing collateral damage for all legitimate certificates previously issued by CAs chained to that root.

Continue reading the full story at InfoQ.