eMudhra CA Key Compromise: Weak Keys in 8 Intermediate CAs Trigger Chrome Blocks and Certificate Updates

On October 20, Google and Cloudflare disclosed that the keys of eight eMudhra intermediate certificate authorities had been compromised. The cause is insufficient randomness in the private keys. That weakness makes it possible to reconstruct the keys and issue forged certificates, which software that still trusts the affected authorities may accept.

What happened

Google received a report from a researcher on October 17. After verifying it, Google prepared a block on the keys through Chrome’s CRLSet mechanism the same day. Google’s public announcement and Cloudflare’s separate account of its response were both published on October 20. That public disclosure is the new development in the period covered by this report.

An intermediate CA key is used to sign other certificates, so its compromise can put connections to many services at risk. However, the ability to impersonate a server does not mean that interception of any specific organization’s traffic has been confirmed.

Who is at risk

Google says the Chrome block is based on public keys, so it also covers any certificates that share the same keys. Because it was delivered through CRLSet, users did not need to restart the browser. That does not mean every other program on the same computer is automatically protected.

Server applications, integration tools and devices that use their own trust stores need to be assessed separately. Google has also announced that it will remove emSign ECC Root CA - G3 from the Chrome Root Store. Operators of websites that rely on this chain should get a certificate from a different trusted hierarchy to avoid availability problems.

What to do now

The list below contains our editorial team’s organizational recommendations. Adapt them to the software you use:

• Check advisories from browser, operating system and TLS library vendors, and apply the relevant updates.
• Identify which applications use their own set of trusted certificates.
• Check the certificate chains of your own services for emSign ECC Root CA - G3.
• Plan the replacement of affected certificates and test connections after the change.
• Do not work around certificate errors by turning off certificate validation.

SecurHUB’s take

Trust stores are part of your infrastructure and need to be inventoried and kept up to date. A security audit can help identify applications whose certificate handling needs dedicated oversight.

Sources: Google, Cloudflare