Chrome to remove eMudhra's emSign ECC Root CA - G3 on 27 October
Google says private keys for eight eMudhra intermediate CAs were generated with weak randomness. Chrome blocked them and will drop the root that signed them.
Google's Chrome and Android security teams said a researcher reported on 17 October that private keys for eight eMudhra subordinate CA certificates were generated with insufficient randomness. That would let anyone forge trusted HTTPS certificates for any website against clients that still trust those CAs.
Chrome pushed a CRLSet update the same day blocking the affected keys, without requiring a browser update. Android devices received an equivalent update through Google Play Services. Google says no certificates chaining to the affected CAs were logged to Certificate Transparency before the block, so CT-enforcing clients, including Chrome, were protected.
Root removal
Google is also removing emSign ECC Root CA - G3 from the Chrome Root Store, with the change expected for all devices on the morning of Tuesday 27 October (PDT). Some legitimate certificates chaining to the root will stop working in Chrome. Google says website operators with such certificates must immediately obtain a new certificate from another hierarchy in the Chrome Root Store, and that eMudhra has committed to help affected subscribers migrate.
Google says it is investigating whether eMudhra's remaining CA certificates should stay in the Chrome Root Store.