Leaked SSL Intermediate Certificates: https connections cannot be trusted

[u/moanos]

curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'
<!DOCTYPE html>

<meta charset="utf-8">
<title>q3k.google.com</title>

<meta name="viewport" content="width=device-width, initial-scale=1" />
<link rel="shortcut icon" type="image/png" href="/favicon.png">

<style>
body {
font: courier, sans-serif;
font-size: 12px;
text-align: center;
margin-top: 100px;
}
</style>
<p>

<b>oh, this is bad</b>
</p>

Yeah, eight SSL Intermediate Certificates of eMudhra have been publicly leaked. All your servers https traffic can be broken right now. Browsers are fine as they have revoked the certificates but as you can see, curl and many other libraries still accept those.

No download can be trusted right now. Remember to not only patch your main systems but every docker container you run.

This is bad 😅

[u/Padgriffin]

I’m jaded enough to not expect consequences out of companies at this point but this is just stupid enough to explain to laypeople how horribly badly they fucked up

“What do you mean their password was the number 4”

[u/Upstairs-Animator878 → u/Padgriffin]

other 7 were also 2 or 3 digits only.

EM DV TLS CA - G3B	eMudhra BV (NL)	156
EM DV TLS CA - G3C	eMudhra Inc (US)	230
EM EV TLS CA - G3B	eMudhra BV (NL)	115
EM EV TLS CA - G3C	eMudhra Inc (US)	56
EM OV TLS CA - G3B	eMudhra BV (NL)	155
EM OV TLS CA - G3C	eMudhra Inc (US)	4
EM OV CS CA - G3B	eMudhra BV (NL)	66
EM OV CS CA - G3C	eMudhra Inc (US)	237

[u/a-frog-with-no-name → u/Upstairs-Animator878]

for reference, how many digits are these supposed to have?

[u/Maria_Thesus_40 → u/a-frog-with-no-name]

Roughly 384 bits of entropy or 2^384, that means a number with at least 116 digits?

[u/Maria_Thesus_40 → u/[deleted]]

Then I stand corrected :) thank you!

[u/SMF67 → u/[deleted]]

Aren't these ECC not RSA though?

[u/AntimatterTNT → u/SMF67]

oh right, so it is actually 256 or 384