Chrome will stop trusting some eMudhra website certificates on October 27

On October 22, eMudhra's board made a rare decision for a certificate authority: to voluntarily exit the global SSL/TLS certificate market, the certificates that guarantee the identity of websites. A few days earlier, the Indian company was at the center of an embarrassing incident: eight of its intermediate certificate keys were so poorly generated that they could be guessed in 256 attempts.

For site operators, the date to remember is October 27. That morning (Pacific time), Google is set to remove the emSign ECC Root CA – G3 root from Chrome. This is the root that signed the eight compromised intermediates, according to Computerworld. Certificates still chained to this root will then stop being trusted by the browser. Mozilla has already removed it from its trust store.

Why the browser is cutting the whole root

With these weak keys, anyone could forge HTTPS certificates for domains they did not control and impersonate a legitimate site, Next points out. Browsers blocked the affected intermediates very quickly. Removing the root goes further: it also affects legitimate certificates issued under it. Google asks their holders to install, without delay, a certificate from another certificate hierarchy trusted by Chrome.

eMudhra's version

eMudhra blames the incident on "human errors," Next reports. In its statement, it says it revoked the affected authorities within 14 hours of discovering the problem. According to the company, no end-user certificate had been issued by these authorities, and its infrastructure was not compromised. Chairman V. Srinivasan explains that SSL/TLS certificates account for only about 1% of the group's global revenue. The company cites rising compliance costs, competition from free certificates and what it considers disproportionate attention on social media.

It promises to replace its customers' certificates free of charge through partners, to keep revocation services running until the issued certificates expire, and to publish a full report on the causes of the incident. Its so-called G1 RSA roots will remain in use during the transition. Its other businesses (electronic signature, enterprise PKI) are not affected.

What to do before October 27?

The browser is only part of the problem. Sakshi Grover, an analyst at IDC quoted by Computerworld, notes that systems with their own certificate store (Java, proxies, embedded devices) remain exposed until they are updated. She considers the risk of exploitation limited, however, since it requires the ability to intercept traffic.

• Search your environment for certificates issued by eMudhra or emSign, and replace those that depend on the emSign ECC Root CA – G3 root.
• Don't settle for a migration to another root from the same issuer: Niyati Daftary (Gartner) sees it as "a possible bridge," not a final destination, and Yash Kadakia (Security Brigade) advises avoiding migrating twice.
• Update your Java environments: according to Azul, Java does not check revocation by default, and its updates add the eight certificates to the JDK blocklist.
• Apply certificate store updates on your Linux systems and network equipment.

That leaves the report promised by eMudhra, with no date so far. It will explain how such weak keys got past the checks.