Since October 20, eight eMudhra certificate authority keys are known to be compromised (https://emudhra.we-have-a-problem.com/). Google protected regular Android phones through Play Services, but /e/OS doesn’t have them, and the 4.4.1 release notes don’t mention any fix.
Because of this, I’m wondering if version 4.4.1 resolves these issues:
- System certificate store: Will /e/ remove the emSign ECC Root CA - G3 (and AAA Certificate Services, if present)?
- Conscrypt blocklist: Will they add the 8 compromised keys to it? Google has done so via Play Services; /e/ does not appear to have implemented this yet.
- /e/OS browser: Will they update its built-in root certificate store, which ignores the system’s?
Another question remains unanswered:
- Does WebView actually follow the system certificate store? Or does it also need a patch?
This is a concern for me because I work in an environment with trade secrets; I cannot use my phone running /e/OS until this is resolved.
On devices that have not received the updated blocklist, users may be able to disable the affected roots in the system trust store. Open Settings and search for Trusted credentials, which is often found under Security, then Encryption & credentials. In the System tab, tap each of the following certificates and choose Disable:
emSign ECC Root CA - G3, listed under eMudhra Technologies Limited
AAA Certificate Services, listed under Comodo CA Limited
The other eMudhra and Comodo certificates in the list are not affected and should be left enabled.
That is indeed the advice given by the disclosure site, and it works for apps that use the system’s trusted store as well as for WebView (tested on my Fairphone 6 e/os v4.3: 0/12 with Firefox after a restart).
Two caveats, however:
The /e/OS browser uses Chromium’sbuilt-in root store and ignores this setting; this can only be fixed via an update. In the meantime, you should use an up-to-date browser like Firefox.
Restart your device after disabling the setting; otherwise, some apps will retain the old trusted list in memory.
In fact, after further investigation, it appears that disabling the four eMudhra roots is not sufficient. The compromised intermediate certificates were also cross-signed by Sectigo’s AAA certificate services (listed under Comodo CA Limited); therefore, the latter must also be disabled. The other eMudhra root certificates are not affected; disabling them is “optional”. The two affected root certificates are “emSign ECC Root CA - G3” and “AAA Certificate Services.”
However, as a safety (and trust) measure, I also followed the practice of disabling all four (and Comodo which is mandatory)
