What responsibility does the CA that signed eMudhra's intermediate cert bear here?

IcePenguin 3 hours ago | parent | next [-]

There may be some scrutiny of Sectigo's part in this, however, they did revoke the cross-signed certs within 24 hours of acknowledging the issue: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c13

"Sectigo has completed the revocation of the affected cross-signed CA Certificates. A new CRL and OCSP responses have been published and are making their way to our CDN edge nodes right now.

We will continue monitoring and evaluating this bug for further updates from Emudhra."

▲

spockz 3 hours ago | parent [-]

Yes that if reactive. But I think GP meant what their responsibility in this is given that they signed and thereby vouched for an intermediate ca that now has become untrustworthy.

	▲	tuwtuwtuwtuw 2 hours ago \| parent [-]
		Apple, Microsoft, Mozilla etc also vouched for eMuhdra right? (honest question, I am blissfully unaware of how this works)

▲

NoahZuniga 2 hours ago | parent | prev | next [-]

I don't think any really. The root that did the cross sign was already removed (not trusted) from the chrome and mozilla root stores before they did the cross sign.

▲

infogulch 2 hours ago | parent | prev [-]

Maybe CAs should spend a few thousand CPU hours trying to crack submitted intermediates before actually signing them.