Repository navigation
Update the root store from Chromium (remove emSign ECC Root CA - G3) - #46
Merged
Merged
Conversation
The private keys of eight eMudhra intermediate CAs issued in 2025 under `emSign Root TLS CA - G3` (cross-signed by `emSign ECC Root CA - G3` and by Sectigo `AAA Certificate Services`) can be recovered from their certificates. This is the same removal as in upstream gRPC (grpc/grpc#43699), but without resynchronizing the rest of the bundle with the Chromium root store. `emSign Root CA - G1` is unaffected and is kept, as in upstream gRPC and certifi. Related: https://emudhra.we-have-a-problem.com/ Related: grpc/grpc#43699 Related: certifi/python-certifi#440 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Take `etc/roots.pem` from upstream gRPC as of grpc/grpc#43699, which regenerated it from the Chromium root store. Besides `emSign ECC Root CA - G3` (removed in the previous commit), this follows the other Chromium root store changes. Related: https://emudhra.we-have-a-problem.com/ Related: grpc/grpc#43699 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Algunenano
approved these changes
Oct 22, 2026
alexey-milovidov
added a commit
to groeneai/ClickHouse
that referenced
this pull request
Oct 23, 2026
The private keys of eight eMudhra intermediate CAs issued in 2025 can be recovered from their certificates. Reject any certificate chain that contains one of them, or one of the roots that issued or cross-signed them (`emSign Root TLS CA - G3`, `emSign Root CS CA - G3`, `emSign ECC Root CA - G3`), regardless of the trust store it was built from, including the trust store of the operating system. The keys are identified by the SHA-256 of their `SubjectPublicKeyInfo`, so the cross-signed certificates of the same keys (issued by Sectigo `AAA Certificate Services`) are rejected as well. The check is done in `Poco::Net::SSLManager::verifyCallback`. Also update the CA certificates embedded into the binary (`contrib/grpc/etc/roots.pem`) from the Chromium root store, which removes `emSign ECC Root CA - G3`. Related: https://emudhra.we-have-a-problem.com/ Related: ClickHouse/grpc#46 Related: grpc/grpc#43699 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update
etc/roots.pemfrom upstream gRPC (grpc/grpc#43699), which regenerated it from the Chromium root store in response to the eMudhra incident.The private keys of eight eMudhra intermediate CAs issued in 2025 can be recovered from their certificates. They are issued by
emSign Root TLS CA - G3(cross-signed byemSign ECC Root CA - G3) and cross-signed by SectigoAAA Certificate Services. This removesemSign ECC Root CA - G3, the only affected root in the bundle, and follows the other recent changes of the Chromium root store (19 roots removed, 3 added).emSign Root CA - G1is unaffected and is kept, as in upstream gRPC and certifi.Note: in ClickHouse, this bundle is not used in typical scenarios. ClickHouse embeds it into the binary only as a fallback for when no CA certificates can be found on the filesystem, e.g. in a container built "from scratch". Whenever the operating system provides a trust store (or a
caConfigis set), the bundle is ignored, and the operating system's trust store is used instead. Distrusting the compromised certificates regardless of the trust store in use is done separately in ClickHouse itself.The first commit removes only
emSign ECC Root CA - G3; the second one makes the file identical to upstream.Related: https://emudhra.we-have-a-problem.com/
Related: grpc/grpc#43699
Related: certifi/python-certifi#440
🤖 Generated with Claude Code