All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
eMudhra CA private keys compromised
neighhouse
Member
I'm surprised there hasn't been a post about this but anyways
Sources:
https://blog.cloudflare.com/emudhra-certificate-compromise/
https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/
https://bugzilla.mozilla.org/show_bug.cgi?id=2083449
Cloudflare published a write-up on the eMudhra certificate incident yesterday. Eight eMudhra intermediate CA certificates had weak private keys, making it possible to derive the keys and forge certificates for arbitrary domains.
That is perhaps a fairly serious WebPKI failure. If an attacker had one of those keys and was in a position to intercept traffic, they could potentially impersonate servers and intercept or modify TLS traffic for clients that still trusted the affected intermediate.
The browser side is relatively straightforward because Chrome, Firefox and others have mechanisms for rapidly distrusting certificates. The more annoying problem is everything outside browsers: old containers, bundled CA stores, language runtimes, appliances and applications that use their own certificate verification path. They specifically points out that passing a browser or curl test does not necessarily mean another application on the same system is protected.
If you run long-lived containers or software with its own CA bundle, it is probably worth checking what trust store it actually uses and rebuilding/updating where necessary. Python's requests component uses a certifi bundle for example.
Saw someone mention on X mitm'd TLS on an iPod Touch 4 without installing a CA cert on it, a perfect example of a old device that will likely never get an update. Haven't replicated it myself in old IoT but will be interesting!
The slightly insane part is that all eight affected P-384 private scalars were below 256. One of the recovered private values was reportedly 4.
Comments
Obligatory mention: https://xkcd.com/221/
Yes the key to the internet (at least was) is 4.
Can't catch a break
I guess this was the reason for the ca-certificates updates.