A CA Compromise and Your 72 Hour Reporting Clock

DFARS 252.204-7012 sets a 72 hour clock. DFARS is the Defense Federal Acquisition Regulation Supplement. The clock starts when you discover a cyber incident that affects covered defense information.

This week's story is not about your server. It is about the certificate authority that signs your server's identity. That can still start an assessment. Here is how to think about it.

What happened

On October 17, 2026, a researcher reported that eight eMudhra intermediate certificates had compromised private keys. The keys were generated with almost no randomness. Anyone could recover them from public data. Six sign TLS traffic. TLS is transport layer security. Two sign code.

Mozilla announced the compromise on the oss-security mailing list. The Mozilla, Microsoft, Apple, and Chrome root programs all trusted these certificates. All four blocked them between October 17 and 20. eMudhra revoked them on October 18.

No end entity certificates appear in Certificate Transparency logs under these intermediates. That limited the damage. It did not close the question for every contractor.

Why the clause cares about a CA failure

The clause requires rapid reporting of cyber incidents. A cyber incident includes any action that jeopardizes the confidentiality of covered defense information. Forged certificates for your public portals could let an attacker impersonate you and harvest credentials. That is a scenario your incident response plan should already cover.

Most contractors will find no eMudhra chain in their systems. That finding is itself evidence. Document it. A dated check that found nothing is an incident assessment record. It proves the clause's process ran.

If you do find the chain, the clock starts. Report through the DoD portal at dibnet.dod.mil within 72 hours. Preserve images of affected systems. The clause also expects you to submit isolated malicious software to the government when it applies.

The three records to keep

First, the assessment record. It names the systems you checked, the method, the result, and the date. Keep it even when the result is clean.

Second, the communication record. It shows you told your prime or your subcontractors what you found, if the clause's flow down applies to them.

Third, the remediation record. It shows the trust store updates landed, with dates and confirmation on each system type, including containers and embedded devices.

What to do this week

Run the eMudhra check across your boundary. Check servers, VPN concentrators, and code signing pipelines. Ask your managed service providers the same question.

Then file the assessment record with your incident response files. The next CA compromise will come with less warning. A practiced process beats a fast scramble.

Sources

• eMudhra Intermediates Compromise, Dennis Jackson, Mozilla, oss-security mailing list, October 20, 2026. https://www.openwall.com/lists/oss-security/2026/10/20/1
• India's cybersecurity agency warns of compromise of eMudhra intermediate CA certificates, CERT-In advisory reported October 21, 2026.
• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting.
• Original diagram by PolicyCortex.

Next step

Want control evidence that pulls itself from your live systems? See how PolicyCortex collects it on Azure.