Re: eMudhra Intermediates Compromise

[Jakub Wilk <jwilk () jwilk net>]

* Solar Designer <solar () openwall com>, 2026-10-21 07:54:
> On Tue, Oct 20, 2026 at 03:44:34PM -0400, Jeffrey Walton wrote:
> > It is probably worth noting the Comodo AAA Services Root removal is 
> > not related to the eMudhra incident.
> Are you sure? Doesn't it cross-sign the compromised intermediates?

It does cross-sign them.

> > The issue with Comodo AAA Services Root was the removal of the TLS 
> > trust bit by browsers because the root is too old. The current 
> > CA/Browser (CA/B) Baseline Requirements (BR) policies say a root has a
> > maximum lifespan of 15 years from creation date. Comodo AAA Services 
> > Root was issued in 2004, so it violates current policy. Also see 
> > <https://cabforum.org/working-groups/server/baseline-requirements/>.

FWIW, I couldn't find such a requirement in CA/B BR.

> This may be right, but perhaps the urgency to remove it now is related 
> to the eMudhra incident?
>
> Incidentally, it is not yet removed in NSS 3.131.1, which does remove 
> the emSign certs.  An omission to fix in a further update urgently?

AFAICT the Comodo AAA cert hasn't been removed from NSS, but it had the 
web trust bit turned off last year:
https://bugzilla.mozilla.org/show_bug.cgi?id=1957685

That said, my Firefox 153 ESR (which is supposed to include that change) 
still trusted the Comodo AAA cert, so I'm confused.

--
Jakub Wilk