Google blocks flawed eMudhra certificates across Chrome and Android

A cryptographic flaw in the key generation process of certificate authority eMudhra exposed the private keys of eight intermediate certificates, making it theoretically possible to forge HTTPS credentials for any website. The vulnerability stemmed from insufficient randomness during key generation, which allowed researchers to reconstruct the private keys directly from corresponding public certificate data.

A security researcher reported the compromise to the Chrome Root Program on October 17. The eight affected intermediates included six used for issuing TLS certificates and two designated for code signing. In public key infrastructure, a compromised intermediate certificate authority is catastrophic: anyone holding the private key can issue seemingly legitimate certificates for arbitrary domains that browsers would inherently trust.

Google moved rapidly to mitigate the issue. On October 17, the company deployed an update to Chrome's CRLSet revocation system, blocking the compromised keys using Subject Public Key Info (SPKI) hashes. This approach blocks any certificate matching the flawed public keys regardless of serial number variations. Devices running Android received a similar update on October 19 via Google Play Services.

The impact appears contained thanks to Certificate Transparency (CT). Google verified that no unauthorized TLS certificates originating from the six compromised intermediates had been logged before the keys were blocked. Because Chrome strictly requires valid CT logs for publicly trusted certificates, forged certificates would have failed validation in the browser. However, clients that do not enforce CT logging remained exposed prior to the revocations.

Google is taking an additional step by removing the emSign ECC Root CA — G3 certificate from the Chrome Root Store, scheduled for rollout on October 27. Websites relying on chains leading to this root will trigger certificate errors in Chrome and must migrate to an alternative trusted root. The Chrome Root Program stated it is currently evaluating whether to maintain trust in the rest of eMudhra's infrastructure.

Source: habr

Primary source: Google Security Blog