Leaked SSL Intermediate Certificates: https connections cannot be trusted

[u/moanos]

curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'
<!DOCTYPE html>

<meta charset="utf-8">
<title>q3k.google.com</title>

<meta name="viewport" content="width=device-width, initial-scale=1" />
<link rel="shortcut icon" type="image/png" href="/favicon.png">

<style>
body {
font: courier, sans-serif;
font-size: 12px;
text-align: center;
margin-top: 100px;
}
</style>
<p>

<b>oh, this is bad</b>
</p>

Yeah, eight SSL Intermediate Certificates of eMudhra have been publicly leaked. All your servers https traffic can be broken right now. Browsers are fine as they have revoked the certificates but as you can see, curl and many other libraries still accept those.

No download can be trusted right now. Remember to not only patch your main systems but every docker container you run.

This is bad 😅

[u/Upstairs-Animator878]

other 7 were also 2 or 3 digits only.

EM DV TLS CA - G3B	eMudhra BV (NL)	156
EM DV TLS CA - G3C	eMudhra Inc (US)	230
EM EV TLS CA - G3B	eMudhra BV (NL)	115
EM EV TLS CA - G3C	eMudhra Inc (US)	56
EM OV TLS CA - G3B	eMudhra BV (NL)	155
EM OV TLS CA - G3C	eMudhra Inc (US)	4
EM OV CS CA - G3B	eMudhra BV (NL)	66
EM OV CS CA - G3C	eMudhra Inc (US)	237

[u/a-frog-with-no-name → u/Upstairs-Animator878]

for reference, how many digits are these supposed to have?

[u/_memark_ → u/a-frog-with-no-name]

Does the table show the actual passwords or the number of bits or digits in the passwords? 🤔

[u/R4ndyd4ndy → u/_memark_]

Those are the actual private keys

[u/MrSnowflake → u/R4ndyd4ndy]

I'm confusing this probably, but aren't (private) keys supposed to be prime numbers?

Edit: Nevermind, in this specific case it's elliptic curve keys which work a bit different.