AWS Drops Trust in eMudhra Certificates: What CloudFront and ALB Customers Must Check Now

AWS has published detailed guidance on removing trust in certificates linked to the eMudhra issue. What’s new is the scope of the changes across AWS cloud services and the actions customers must take themselves, including a deadline to replace affected identity provider certificates before October 28. The bulletin is dated October 24 at 8:00 p.m. PDT and was published on October 25 at 03:00 UTC, within the required window.

What’s New Since the Earlier Warnings

SecurHUB has previously reported on the weak eMudhra keys. This latest notice gives AWS users operational details: which trust stores are being updated, where customers have to act themselves, and when the changes could affect connections.

AWS names three root certificates: AAA Certificate Services, emSign Root TLS CA – G3, and emSign ECC Root CA – G3. Among other things, the trust removal affects how AWS verifies outbound connections to customer-specified servers. This does not mean AWS has been breached. In this bulletin, AWS does not report any observed attacks exploiting the issue.

Who Is Affected

CloudFront administrators should check the certificate chain of their origin servers. If the chain leads to one of the certificate authorities being removed, the trust store update may cause TLS connections to be rejected. AWS has set October 28 as the target date for rolling out this change.

Application Load Balancers that use OIDC or JWT authentication need a separate review. If the identity provider’s certificate chains to one of the listed authorities, AWS recommends replacing it before October 28. AWS’s timeline calls for updating existing ALBs between October 29 and October 31. These are planned dates, not confirmation of the status of any specific account.

What to Do Now

• Review AWS Health notifications for the services you use.
• Verify the certificate chains of your CloudFront origins and ALB identity providers.
• Replace affected certificates following AWS instructions, then test your connections.
• Update the ca-certificates package on Amazon Linux and the Amazon Corretto releases you use.
• Check your Python application dependencies; AWS specifies botocore 1.43.117 or later.
• Do not disable certificate verification to work around connection errors.

SecurHUB’s Take

Changes to certificate authority trust can affect service availability and user sign-in. Security audits help identify dependencies on certificate stores and plan how to verify integrations after the changes.

Sources: AWS Security Bulletin, TechGeeks