Certain eMudhra intermediate Certificate Authority (CA) certificates have been compromised, potentially allowing attackers to impersonate websites or services by presenting fraudulent certificates. Devices and applications that continue to trust these certificates may be vulnerable to man-in-the-middle attacks.
The private keys associated with eight eMudhra intermediate CA certificates were compromised due to a flaw in their generation. These certificates chain to trusted root certificates, potentially affecting operating systems, applications, and libraries that rely on certificate trust stores.
Although browser and operating system vendors have implemented mitigations, some clients may continue to trust the compromised certificates if they rely on outdated certificate bundles or do not consume revocation information.
For more information, refer to the eMudhra Intermediate CA Compromise advisory.
The recommended resolution is to patch the affected endpoints with the relevant security updates to address the compromised certificate issue. Use the following platform-specific remediation methods.
Internet-connected Windows devices receive certificate distrust updates through the native Windows certificate update mechanism, which operates on a 24-hour cycle.
For devices that cannot receive these updates, including those in air-gapped environments, deploy the applicable out-of-band (OOB) updates using Endpoint Central Patch Management.
Monitor the deployment status in Endpoint Central and verify that the applicable updates are installed successfully.
Deploy the remediation script as a Computer-based Configuration in Endpoint Central.
Remediation steps:
Download the macOS remediation script.
Configure the script as a Computer-based Configuration in Endpoint Central.
Deploy the configuration to the targeted macOS devices.
When prompted, ask the logged-in user to review the remediation explanation and obtain administrator authorization to modify certificate trust settings.
The script checks the trust status of the affected certificates and applies the required distrust settings when necessary.
Verify the execution status in Endpoint Central. The script returns SUCCESS (exit code 0) if verification passes or FAILURE (exit code 1) if verification fails.
Script integrity verification
Before deploying the macOS remediation script, verify its integrity using the following SHA-256 hash.
Script: remediate-emudhra-macos.sh
SHA-256: d4313de0e210a629afae2014f43e84ffcf844cd7f4d20d20acae82db7f9ba996
Ensure that the calculated SHA-256 hash of the downloaded script matches the value above before deployment.
Note: Administrator authorization is required to modify certificate trust settings. The script prepares the required distrust settings while preserving existing settings and verifies the result after the changes are applied.
Deploy the remediation script using the Custom Script Configuration in Endpoint Central.
Remediation steps:
Download the Linux remediation script.
Configure the script as a Custom Script Configuration in Endpoint Central.
Deploy the configuration to the targeted Linux devices with the required administrative privileges.
The script attempts to update the distribution's ca-certificates package before applying additional certificate trust changes.
The script verifies the SHA-256 fingerprint of the affected emSign ECC Root CA - G3 certificate before distrusting it.
The script blocks the 16 compromised intermediate certificates and cross-signs using the appropriate mechanism for the Linux distribution.
The script retains trust in the AAA Certificate Services root to minimize disruption to unaffected legacy websites that depend on it.
Verify the execution status in Endpoint Central. The script reports RESULT: SUCCESS or RESULT: FAILURE and returns exit code 0 or 1, respectively.
Script integrity verification
Before deploying the Linux remediation script, verify its integrity using the following SHA-256 hash:
fe00fa01a088c7706a05b4c50e49818e416694600811c0601f903e6d67d685ab
Ensure that the calculated SHA-256 hash of the downloaded script matches the value above before deployment.
After deployment:
Confirm that the script executed successfully on the targeted devices.
Verify that the affected certificates are no longer trusted by the relevant system trust store.
Investigate devices reporting a failure and review the script execution logs.
Check whether applications using independent certificate bundles require separate updates or remediation.
Important: Updating the operating system or browser may not remediate applications that maintain their own certificate bundles. Ensure that such applications are updated or addressed separately.
