The private keys of eight eMudhra intermediate CA certificates, trusted by major root programs, have been compromised. Check whether your client is affected and how to protect it.
Update your stuff, folks. I’ve had a fun day at work.
I read that statement to mean that no end-user certs were signed by these 8 intermediate CAs using the normal process of sending in a CSR. But precisely because the private keys were badly generated, everyone can use those CA’s keys to sign their own CSRs, which would give them a trusted cert for any domain that they want, which also won’t generate CT logs.
When the risk is “will our web browsers trust an illegitimate cert?”, then it is 100% reasonable and appropriate to recommend a temporary halt to using affected web browsers, until such time that mitigations are fully in place.
I read that statement to mean that no end-user certs were signed by these 8 intermediate CAs using the normal process of sending in a CSR. But precisely because the private keys were badly generated, everyone can use those CA’s keys to sign their own CSRs, which would give them a trusted cert for any domain that they want, which also won’t generate CT logs.
When the risk is “will our web browsers trust an illegitimate cert?”, then it is 100% reasonable and appropriate to recommend a temporary halt to using affected web browsers, until such time that mitigations are fully in place.