Chrome and Firefox block eight eMudhra certificate authorities after weak private keys are found

Google and Mozilla have blocked eight intermediate certificate authorities run by Indian certificate provider eMudhra after a security researcher reported that their private keys had been generated with insufficient randomness, the companies said.

In a post dated 20 October, Google’s Chrome and Android security teams said the Chrome Root Program received the report at 6:05pm GMT on Saturday 17 October. The weak keys meant “anyone” could forge trusted HTTPS certificates to impersonate any website for clients that still trusted those authorities, Google said. Chrome pushed an update blocking the affected keys at 7:45pm GMT the same day, without requiring a browser update. Android devices received an equivalent update through Google Play Services on Monday.

Google said no certificates chaining to the affected authorities had been logged to Certificate Transparency before its block, so no fraudulent certificate from them could have been used against clients that enforce it, including Chrome. Mozilla said it blocked the certificates for Firefox users through its OneCRL revocation list on 17 October and released Firefox 158.0.1 on 20 October for users who do not receive OneCRL updates, 9to5Linux reported.

Google is also removing the root certificate that signed them, emSign ECC Root CA - G3, from the Chrome Root Store, with the change due on the morning of Tuesday 27 October Pacific time. Some legitimate certificates will stop working in Chrome as a result, and Google said affected website operators must obtain new certificates from another provider. Google said eMudhra has committed to working with affected customers to move them off the root, and that it is reviewing eMudhra’s remaining certificates in its root store.