Google Chrome to distrust newer Chunghwa Telecom digital certificates

Taipei, June 3 (CNA) Google's Chrome browser will no longer automatically trust new digital certificates issued by Chunghwa Telecom after July 31, 2025, citing "compliance failures," a decision Chunghwa Telecom said was not related to any cybersecurity issues.

The decision was made public in a May 30 blog post by the Chrome Security Team on the Google Security Blog.

It said Google Chrome -- which accounts for around 65 percent of global browser usage -- will remove its default trust in TLS (Transport Layer Security) certificates issued by Chunghwa Telecom for any certificates issued after July 31.

A TLS certificate is a digital certificate that secures internet connections by encrypting data transmitted between a user's browser, the website being visited, and the website's server, according to TLS solution provider DigiCert.

Chunghwa Telecom, Taiwan's largest telecom provider, is one of the certificate authorities (CAs) in Taiwan whose TLS certificates have been trusted by Chrome, meaning they have been automatically accepted by the browser.

After July 31, Chrome users -- especially those using version 139, scheduled for release on Aug. 1 -- who visit websites using certificates issued by Chunghwa Telecom after that date will, by default, see a full-page security warning.

The warnings will contain such messages as "Your connection is not private" and "Attackers might be trying to steal your information from [the website]."

Google's security team explained the move by saying, "we have observed a pattern of compliance failures, unmet improvement commitments, and the absence of tangible, measurable progress in response to publicly disclosed incident reports" from Chunghwa Telecom in the past several months and years.

"Chrome's confidence in the reliability of Chunghwa Telecom and Netlock [a CA based in Hungary] as CA Owners...has diminished due to patterns of concerning behavior observed over the past year," the team said.

In response to the announcement, Chunghwa Telecom -- in which Taiwan's Ministry of Transportation and Communications holds a 35.29 percent stake -- said in a statement Monday that its removal from the list of trusted CAs "was definitely not due to any certificate vulnerabilities or private key leaks."

"The reason was that some procedures were not adjusted in time to meet Chrome's new policy requirements," Chunghwa Telecom said.

The company said it had recently completed those adjustments and now fully complies with the updated policy, but Chrome still decided to proceed with removing its default trust.

Chunghwa Telecom said all certificates issued before July 31 will remain valid and trusted in Chrome and noted that it is working to regain default trust status and expects to complete its compliance work by March 2026.

With users of other browsers, such as Safari and Edge, unaffected, the telecom company said its certificate authority operations comply with Taiwan's Electronic Signature Act and international standards.

At a news conference Tuesday morning, Wang Chen-ming (王誠明), head of the Ministry of Digital Affairs' Department of Digital Service, also insisted that the issue behind the certificate trust removal was not related to cybersecurity.

Chunghwa Telecom's technology and standards for issuing TLS certificates are consistent with international counterparts, Wang said, asserting that there were "no security concerns" and that the issue mainly was due to the local company's "inadequate management and operational procedures."

Regarding the impact on government websites, MODA said in a statement Monday that the government has implemented a dual-certificate mechanism since March by adding certificates from other domestic CAs to ensure secure operations across all major browsers.

"In other words, users accessing government websites via Chrome can still enjoy full secure connection protection and do not need to worry about browser warnings or display issues," the statement said.