eMudhra intermediate certificates still present in NSS 3.131.1

What happened and what to do

On 20 October 2026, Solar Designer posted a reply on the oss-sec list under the subject about compromised eMudhra intermediaries. The message asks whether compromised intermediate certificates are still cross-signed and suggests that the urgency to remove them may be tied to the eMudhra incident. It also notes that these certificates were not removed in NSS 3.131.1, the release that removes the emSign certificates, and calls the omission something to fix urgently in a future update.

In practical terms, a company that relies on libraries with their own trust store, such as NSS, or that maintains internal chains of trust needs to know exactly which intermediaries each environment accepts. The case calls for an inventory of certificate bundles across servers, containers, applications and devices, with the library version of each, and a pipeline that compares those bundles against trust lists and published incident alerts. It is also worth checking whether validation chains for critical services would accept compromised intermediaries and, where needed, defining temporary blocking rules, controlled pinning and an update plan monitored end to end.

How the consultancy can help

Diagnosis of exposure to compromised intermediaries in environments that use NSS or their own trust stores, covering library inventory, certificate bundles and validation chains. Then design and implementation of continuous monitoring that compares trust lists with incident alerts and records the affected services.

Next step

If your company uses NSS or maintains its own trust chains and needs to know whether compromised intermediaries are still accepted, send a short description of your environment and your case. You will receive a proposal with scope, timelines and delivery format.