- Mozilla says private keys for eight eMudhra intermediate certificates were compromised, and it blocked them in Firefox within three hours of the report.
- A minority of Firefox users with custom settings, and other software built on Mozilla's trust store, may not have received the block automatically.
- Leaders should ask which trust stores their software relies on and how each one receives revocations.
Trust is a list someone has to keep current
Every time a browser shows a padlock, it is relying on a list. The list names the organisations whose certificates the browser will believe. When one of them loses control of its keys, the list must change fast. The speed of that change is the real test of the padlock.
Mozilla has just shown what a fast change looks like. It has also shown who may be left out.
What Mozilla reported
Mozilla received a report late on Saturday, October 17. The time was 20:06 UTC. The report said private keys tied to eight eMudhra intermediate certificates had been compromised.
Mozilla says an attacker holding such keys could issue fake HTTPS certificates for sites they do not own. Someone who could also intercept a user's connection could then pose as those sites. Mozilla says that attacker could potentially read or change the traffic.
Mozilla's engineers blocked the eight certificates in Firefox. They used OneCRL, which is Mozilla's central list of revoked certificates. Mozilla says the update had reached every Firefox user with standard settings by 22:59 UTC that day. That is under three hours after the report.
How the fix works
An intermediate certificate sits between a browser's trusted root and a website's own certificate. The root vouches for the intermediate. The intermediate vouches for the site.
So whoever holds an intermediate's private key can sign certificates that browsers will accept. That is why leaked keys matter. Blocking the intermediates tells Firefox to reject anything they signed.
Mozilla says OneCRL needs no Firefox update and no restart. That design explains the speed. The block travels as data, not as a new version of the software.
Who the fast fix may not reach
Mozilla points to two groups on a slower path.
The first is a minority of Firefox users. Their custom settings may have stopped the OneCRL update from arriving. Mozilla is shipping new builds for them: Firefox 158.0.1 for Desktop and Android, Firefox ESR 115.43.1 and Firefox ESR 153.5.1.
The second group is other software. Mozilla has also released NSS 3.131.1, an update to its trusted certificate list. It drops the root certificate that signed the eight intermediates. Mozilla says this protects programs that use its trust store, or a copy derived from it, but get no OneCRL updates.
Here is the lesson for organisations. Firefox was covered within hours because it listens to a central revocation feed. Mozilla's own wording implies other programs built on its list may not listen. They depend on a package update. That arrives on the maintainer's schedule, not the attacker's.
What the report does not say
Mozilla's post leaves several gaps. It does not say how the keys were compromised or who made the report. It does not say whether anyone issued or used a fraudulent certificate. It does not describe what other browsers or vendors have done.
Mozilla promises more details once circumstances allow.
Until then, read the risk as stated. The keys could allow fraudulent certificates. Nothing in the post says that has happened.
Questions to put to your team
Start with an inventory. Which applications, devices and internal tools keep their own certificate trust store instead of using the operating system's? Which of those are built on Mozilla's NSS or a copy of it?
Then ask how each one learns about a revocation. Some will take it from a live feed. Others learn only when someone ships a new version. Find out which is which, and who owns the update.
Finally, check your Firefox fleet. If you manage custom browser settings, confirm they do not block OneCRL updates. Plan a move to Firefox 158.0.1 or the matching ESR release.
Mozilla acted in under three hours. The remaining risk sits in software that copies its list and updates more slowly.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Mozilla.
