r/linux • u/moanos • 1d ago

Security Leaked SSL Intermediate Certificates: https connections cannot be trusted 

curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'
<!DOCTYPE html>

<meta charset="utf-8">
<title>q3k.google.com</title>

<meta name="viewport" content="width=device-width, initial-scale=1" />
<link rel="shortcut icon" type="image/png" href="/favicon.png">

<style>
body {
font: courier, sans-serif;
font-size: 12px;
text-align: center;
margin-top: 100px;
}
</style>
<p>

<b>oh, this is bad</b>
</p>

Yeah, eight SSL Intermediate Certificates of eMudhra have been publicly leaked. All your servers https traffic can be broken right now. Browsers are fine as they have revoked the certificates but as you can see, curl and many other libraries still accept those.

No download can be trusted right now. Remember to not only patch your main systems but every docker container you run.

This is bad 😅

801 Upvotes

95% Upvoted

213 comments sorted by

View all comments

350

u/spellcasterGG 1d ago

Since OP failed to provide a source, here's the only article I was able to find regarding this.

The Hacker News: Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns

115

u/segv 1d ago edited 1d ago

Sorry for the hijack, but here's some moar info:

 

Additional discussion and background info is on:

 

Note that this CA used to be widely trusted, so a ton of devices are vulnerable. This includes those that are not-so-easy to patch, like IOT/embedded, phones or consoles (VMs and docker images too, but that should be obvious).

9

u/trappler23 1d ago

Thank you