r/linux • u/moanos • 1d ago

Security Leaked SSL Intermediate Certificates: https connections cannot be trusted 

curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'
<!DOCTYPE html>

<meta charset="utf-8">
<title>q3k.google.com</title>

<meta name="viewport" content="width=device-width, initial-scale=1" />
<link rel="shortcut icon" type="image/png" href="/favicon.png">

<style>
body {
font: courier, sans-serif;
font-size: 12px;
text-align: center;
margin-top: 100px;
}
</style>
<p>

<b>oh, this is bad</b>
</p>

Yeah, eight SSL Intermediate Certificates of eMudhra have been publicly leaked. All your servers https traffic can be broken right now. Browsers are fine as they have revoked the certificates but as you can see, curl and many other libraries still accept those.

No download can be trusted right now. Remember to not only patch your main systems but every docker container you run.

This is bad 😅

795 Upvotes

95% Upvoted

213 comments sorted by

View all comments

151

u/MaybeTheDoctor 1d ago edited 1d ago

Centralized certs are bad, and there really should be a bigger emphasis on RFC 6698 for distributed keys tied to domain names and not trusting some authority to issue and keep secrets.

0

u/Kuipyr 1d ago

Centralized is perfectly fine if HSMs are used.

9

u/Defiantlybeingsalad 1d ago

Guess what was used (an HSM)

8

u/Mission_Rice3045 1d ago

Guess what wasn't used (entropy)