The private keys of eight eMudhra intermediate CA certificates, trusted by major root programs, have been compromised. Check whether your client is affected and how to protect it.
Update your stuff, folks. I’ve had a fun day at work.
Unless for some reason they’ve overridden that capability while being unable to issue patches in a timely manner due to process overhead, but nobody would be that stupid right?
There are no entries in the certificate transparency logs for these intermediates in that period, indicating that CT-enforcing clients like Firefox, Chrome, Edge and Safari could not have been attacked.
I read that statement to mean that no end-user certs were signed by these 8 intermediate CAs using the normal process of sending in a CSR. But precisely because the private keys were badly generated, everyone can use those CA’s keys to sign their own CSRs, which would give them a trusted cert for any domain that they want, which also won’t generate CT logs.
When the risk is “will our web browsers trust an illegitimate cert?”, then it is 100% reasonable and appropriate to recommend a temporary halt to using affected web browsers, until such time that mitigations are fully in place.
IT department told us to not use any browser until further notice lol
Jfc it’s patched in just about all of them now.
Unless for some reason they’ve overridden that capability while being unable to issue patches in a timely manner due to process overhead, but nobody would be that stupid right?
They can’t check if it’s parched because they can’t use their browsers
It’s back to curl, bois
I wonder if they didn’t read this section:
or if they did read it, but don’t trust it.
I read that statement to mean that no end-user certs were signed by these 8 intermediate CAs using the normal process of sending in a CSR. But precisely because the private keys were badly generated, everyone can use those CA’s keys to sign their own CSRs, which would give them a trusted cert for any domain that they want, which also won’t generate CT logs.
When the risk is “will our web browsers trust an illegitimate cert?”, then it is 100% reasonable and appropriate to recommend a temporary halt to using affected web browsers, until such time that mitigations are fully in place.