Hacker News Reader

Comment by sippingabonedry | Hacker News Reader

I believe these intermediates chained up to a third party root.

They chain up to emSign & Comodo:

https://groups.google.com/a/mozilla.org/group/dev-security-p...

To be clear, emSign is another name for EMudhra, and Comodo is now known as Sectigo. (You can't just look at the organization name in a certificate subject; you have to consult the CCADB: https://www.agwa.name/blog/post/the_certificate_issuer_field...)

Argh. Thanks for clearing that up.

Since they are also a root CA, are they allowed to audit themselves, or do the browser root programs require third-party audits?

I can't imagine one part of a business being on the up and up, and the guys down the hall running completely rogue.

Third party audits from a qualified auditor are required, although the CA chooses and pays the auditor, and the auditors are basically just accountants. So it's... not a perfect system.

Love this quote:

Inclusion in the Chrome Root Store requires that a CA Owner continuously demonstrate the technical competence and operational rigor necessary to protect Chrome users. Due to the seriousness of this incident, the Chrome Root Program is conducting a thorough evaluation regarding the status of eMudhra’s remaining CA certificate to ensure these standards continue to be met. We will share further updates as our review progresses.

from a post on https://groups.google.com/a/mozilla.org/g/dev-security-polic...

It's been a while since there was a good CA death penalty case.

Given Wayne's hints in the timeline that this issue was discovered by an agent, it might be one of the first big corporate death sentences due to AI?

I bet Entrust never made a cert with a private key of 4.

The problem is the death penalty case is aimed at the wrong target: The entire Web PKI system remains dumb and bad, and the correct answer is to dissolve the CA/B and find people with practical security experience.

Entrust (now Sectigo) is involved with this [0] (cross signed an intermediate) [1] Even last year buying a Sectigo cert got you an Entrust cert with no mention of Sectigo/Comodo[2] (maybe more of a Character.AI situation than a sale)

[0] https://emudhra.we-have-a-problem.com/roots.json

[1] https://www.entrust.com/company/newsroom/entrust-sells-publi...

[2] https://www.sectigo.com/comodo

> Entrust (now Sectigo) is involved with this

This is probably a rough definition for "Entrust was banned from being a CA and sold the business off to a competitor". In part, because I also do not think the root programs would just allow Entrust to continue operating the same business under another brand name, unless they are even dumber than I already thought.

The other solution is web of trust. Which works waaaaay better but is really complicated to implement.

I'm not sure there is a 3rd solution to this.

Given the amount of progress the CAB forum has led in the last decade+, I'm not sure I agree with that diagnosis. Plenty of people in the forum I can think of who have forced positive changes due to the strength of their experience.

If anyone should be navel-gazing coming out of this incident, surely it's the trust store maintainers. If there's a big concrete improvement to be made, short of burning down the web PKI ecosystem, I'm not sure it's obvious yet.

Slightly funny about this: even Wayne (the person who reported it to Chrome & Mozilla) got confused [https://bugzilla.mozilla.org/show_bug.cgi?id=2083449]:

  2026-10-17 20:18 - Full CCADB check finds the cross-signs by Sectigo are also affected

(…the "cross-signs" use the same keypair of course.)

Reply on news.ycombinator.com