Cato has removed 11 eMudhra Certificate Authority (CA) certificates from the trust store used for TLS inspection following a reported compromise of private keys associated with eight intermediate CA certificates. These keys could allow an attacker to issue fraudulent certificates and impersonate legitimate websites.
For more information, see this eMudhra statement.
What Cato has done
We removed the eight compromised intermediate CA certificates and three associated root CA certificates. The root certificates were removed due to substantiated security concerns.
Cato deployed this update centrally across our global Points of Presence (PoPs). No configuration changes are required from you to receive the update.
Next steps
Connections may still be trusted if their certificate chains include an affected intermediate CA certificate and validate through a different trusted root CA (AAA Certificate Services).
We will deploy the additional fixes across our PoPs, confirm their successful deployment, and announce the fixes in the weekly Product Update.
Potential connectivity impact
We expect limited connectivity impact overall and are monitoring the situation. The change may cause connections to some websites, including certain US university websites, to be rejected during TLS inspection.
If you experience significant connectivity issues, please contact Cato Support immediately.
Workaround: Create a site-specific TLS inspection rule that allows untrusted server certificates may restore access to an affected website. For more information, see this article.
However, only use this workaround with caution, because it weakens certificate validation and may allow connections to untrusted servers.
Removed certificates
The following tables list the removed certificates and their SHA-256 fingerprints.
Intermediate CA certificates:
Intermediate CA Certificate | SHA-256 fingerprint |
|---|---|
EM DV TLS CA - G3B | 42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493 |
EM DV TLS CA - G3C | 0164D7CEAE5BB909C272AF151FF44B1177AE9B47D9424B94F1D9558C30934D19 |
EM OV TLS CA - G3B | 98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B |
EM OV TLS CA - G3C | CB6E15165AC802E9B3F993F16C25D41F4E81C21EBDE71AE1B012AC00BF9C7C3F |
EM EV TLS CA - G3B | E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838 |
EM EV TLS CA - G3C | 432EC25F0D28DE9006D97BF752F17BBB2CD41F669933FCB072D9A1148D0261F3 |
EM OV CS CA - G3B | 9E39DE2881273ACC225A149C72BA3E0F51424963669AB633EE1DC7DF5DB067B4 |
EM OV CS CA - G3C | 4B2460A466F95FD40113BCDCCA2CEB29B3B093921DE45474DA7DF48874C630B1 |
Root CA certificates:
Root CA Certificate | SHA-256 fingerprint |
|---|---|
emSign Root TLS CA - G3 | 7DD78D5F4F13459A83DFF9ABBBA62EDBAF6F2D102BF257FD712F4D9F2746ED8D |
emSign ECC Root CA - G3 | 86A1ECBA089C4A8D3BBE2734C612BA341D813E043CF9E8A862CD5C57A36BBE6B |
emSign Root CS CA - G3 | F2EDAAFF3D9B701FB4D14C9F285F8C0BAD90FC3BCC1FA07D47F4718EDABA34A5 |
For more information
Please use the Cato Ask AI agent in the CMA for questions related to the TLS Inspection policy.
Take me to the CMA AI Workspace.