Cyber ·
Radar: open question on compromised eMudhra intermediate certificates in NSS 3.131.1
A reply on the oss-sec mailing list asks whether compromised eMudhra intermediate certificates are still being cross-signed and notes that they remain in NSS 3.131.1, a release that removes emSign certificates.
According to the curated text, a reply posted to the oss-sec mailing list, machine-translated in the feed, raises two questions about the compromise of eMudhra intermediate certificates. The first asks whether compromised intermediates should not be cross-signed, and whether the urgency to remove them could be related to the incident. The second notes that these certificates have not yet been removed in NSS 3.131.1, a release that removes emSign certificates, and suggests addressing that omission in a future update. The original message was posted on 20 October and the item was recorded in the feed on 21 October 2026.
This is a technical discussion, not an official statement: the text does not confirm the final scope, a full timeline, or any decision by maintainers. To verify, consult the original oss-sec archive entry indicated in the source, follow the notice published by eMudhra, and review the NSS release notes before drawing conclusions.
Original source: Re: Comprometimento de intermediárias da eMudhra