Mozilla Security Blog

blog.mozilla.orgDR 96 Accessible 300 views

Development & Programming The official Mozilla Security Blog publishes advisories and incident reports about Firefox security, including certificate compromises and the protections Mozilla deploys for users.

Visit now Favorite

Editor's Review

For reference only

This post is a concise incident write-up: it explains the compromise of eight eMudhra intermediate certificates, the risk of fraudulent HTTPS certificates, and how Mozilla blocked them via OneCRL within about three hours without requiring user action. It also notes the accompanying Firefox 158.0.1 a

Site introduction

The Mozilla Security Blog is Mozilla’s official channel for security announcements affecting Firefox and related products. This particular post documents Mozilla’s response to a reported compromise of private keys tied to eight eMudhra intermediate certificates, which could have enabled attackers to issue fraudulent HTTPS certificates and impersonate websites.

The core of the response was OneCRL, Mozilla’s centralized list of revoked certificates. Mozilla engineers blocked the affected certificates shortly after receiving the report, and the updated OneCRL distribution reached all Firefox users with standard configurations in under three hours, without requiring an update or restart. Mozilla also released Firefox 158.0.1 for Desktop and Android, plus Firefox ESR 115.43.1 and ESR 153.x updates.

The post is aimed at Firefox users who want to understand what happened and what protects them, as well as security researchers, IT administrators, and anyone tracking certificate authority incidents and browser trust decisions. It assumes some familiarity with intermediate certificates and revocation mechanisms.

Readers can use the post as a reference for how quickly certificate revocations propagate through Firefox, and as a prompt to keep browsers current. Administrators managing Firefox deployments should note the ESR releases mentioned. Overall, it is a clear, factual account of a coordinated security response.