Leaked SSL Intermediate Certificates: https connections cannot be trusted

[u/moanos]

curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'
<!DOCTYPE html>

<meta charset="utf-8">
<title>q3k.google.com</title>

<meta name="viewport" content="width=device-width, initial-scale=1" />
<link rel="shortcut icon" type="image/png" href="/favicon.png">

<style>
body {
font: courier, sans-serif;
font-size: 12px;
text-align: center;
margin-top: 100px;
}
</style>
<p>

<b>oh, this is bad</b>
</p>

Yeah, eight SSL Intermediate Certificates of eMudhra have been publicly leaked. All your servers https traffic can be broken right now. Browsers are fine as they have revoked the certificates but as you can see, curl and many other libraries still accept those.

No download can be trusted right now. Remember to not only patch your main systems but every docker container you run.

This is bad 😅

[u/Kevin_Kofler]

But then you need a secure DNS transport. Most DNS lookups out there still happen over unencrypted UDP. Neither DNSSEC nor DNS over TLS is widely deployed. And of course DNS over TLS relies on TLS (the modern version of SSL, often still called by its obsolete name) being secure.

[u/iAmHidingHere → u/Kevin_Kofler]

TLS (the modern version of SSL, often still called by its obsolete name)

Modern version from the previous century. The protocol has stood the test of time.

[u/Kevin_Kofler → u/iAmHidingHere]

Yes. It has been many years since it was actually called "SSL".

And actually, there have been several revisions of TLS (with version numbers), and the oldest ones are also obsolete nowadays.

[u/corruptboomerang → u/Kevin_Kofler]

I was taking to a very young coworker about this, and they didn't know what SSL was, when I said TLS/SSL. They'd never heard of SSL.

[u/ferminolaiz → u/corruptboomerang]

Kinda wild but kinda good at the same time!

[u/CassadeeBTW → u/corruptboomerang]

Millennial here! Would have looked at you like a deer in the headlights if you said TLS instead of SSL!