eMudhra TLS compromise found in trust stores

Following the compromise of eight eMudhra intermediate certificate authorities, researchers evaluated trust stores and real-world clients to determine how removing the affected roots impacts systems outside browsers. They found that stores built from older Mozilla data require removing both the emSign root and AAA Certificate Services to fully block the compromised keys, though some runtimes deploy built-in blocklists that bypass stale trust stores. In OpenSSL tests, removing the AAA root broke only one served chain among 16,125 analyzed sites. Open article →