eMudhra Intermediate Certificate Vulnerability

Actions to Take:

Notify your Information Technology department immediately and review the corrective actions below.

Issue:

A security researcher reported that private keys associated with eight eMudhra intermediate certificates had been compromised. Mozilla independently verified the weakness. The affected certificates were widely trusted by browsers, operating systems, and other software.

Impact:

Attackers could use the compromised keys to create fraudulent certificates for any domain, impersonate websites and servers, and intercept or modify traffic. Computers and applications that continue to trust the affected certificates may be vulnerable.

Essent Service Impact:

Although Essent doesn't use any certificates issued by eMudhra and there are no known exploits, but low-level infrastructure used by Essent may be vulnerable.

The same situation exists for Essent Subscribers using subscriber-issued certificates and anyone using a computer or Internet-connected device.

Corrective Action:

Essent has updated all certificates under its control as a preventative measure. Subscribers with customer-issued certificates should update all of their certificates immediately, contacting Essent Support as needed for assistance and coordination.

All computer users should update their web browsers, operating systems, and other software that relies on certificates to the latest releases as soon as possible, including available security and certificate trust updates.

More information:

Mozilla: eMudhra Certificate Compromise Incident Record
https://bugzilla.mozilla.org/show_bug.cgi?id=2083449