Firefox blocks certificates after a CA private key compromise
Eight eMudhra intermediate certificates had compromised private keys. Mozilla blocked them in hours, then shipped Firefox 158.0.1 and NSS 3.131.1 to cover everyone else.
Mozilla says it received a report on 17 October at 20:06 UTC that the private keys behind eight eMudhra intermediate certificates had been compromised. Anyone holding those keys could issue fraudulent HTTPS certificates for sites they do not control, and use them to impersonate those sites to anyone whose connection they could intercept.
Mozilla’s first response was OneCRL, its centralised revocation list: the affected certificates were blocked there by 22:59 UTC the same day, under three hours after the report landed, reaching every Firefox user with a standard configuration without an update or restart. For users whose custom settings stop OneCRL updates from reaching them, Mozilla has now shipped Firefox 158.0.1 for desktop and Android, plus ESR 115.43.1 and 153.5.1, on 20 October. It also released NSS 3.131.1, removing the root that signed the compromised intermediates, to protect other software built on Mozilla’s trust store that does not pull OneCRL updates itself.
Why it matters: a compromised CA key breaks the assumption that a valid certificate means a genuine site, and this is a reminder of how much of that trust depends on a revocation list most people never see. If you ship software that bundles its own copy of NSS rather than relying on OneCRL, this is the version to pull in.
The caveat: OneCRL alone already protects standard Firefox installs. The new releases exist specifically for custom configurations and non-Firefox NSS consumers, not because the earlier fix was incomplete.