The private keys of eight eMudhra intermediate CA certificates, trusted by major root programs, have been compromised. Check whether your client is affected and how to protect it.
Update your stuff, folks. I’ve had a fun day at work.
There are no entries in the certificate transparency logs for these intermediates in that period, indicating that CT-enforcing clients like Firefox, Chrome, Edge and Safari could not have been attacked.
I read that statement to mean that no end-user certs were signed by these 8 intermediate CAs using the normal process of sending in a CSR. But precisely because the private keys were badly generated, everyone can use those CA’s keys to sign their own CSRs, which would give them a trusted cert for any domain that they want, which also won’t generate CT logs.
When the risk is “will our web browsers trust an illegitimate cert?”, then it is 100% reasonable and appropriate to recommend a temporary halt to using affected web browsers, until such time that mitigations are fully in place.
I wonder if they didn’t read this section:
or if they did read it, but don’t trust it.
I read that statement to mean that no end-user certs were signed by these 8 intermediate CAs using the normal process of sending in a CSR. But precisely because the private keys were badly generated, everyone can use those CA’s keys to sign their own CSRs, which would give them a trusted cert for any domain that they want, which also won’t generate CT logs.
When the risk is “will our web browsers trust an illegitimate cert?”, then it is 100% reasonable and appropriate to recommend a temporary halt to using affected web browsers, until such time that mitigations are fully in place.