Leaked SSL Intermediate Certificates: https connections cannot be trusted

[u/moanos]

curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'
<!DOCTYPE html>

<meta charset="utf-8">
<title>q3k.google.com</title>

<meta name="viewport" content="width=device-width, initial-scale=1" />
<link rel="shortcut icon" type="image/png" href="/favicon.png">

<style>
body {
font: courier, sans-serif;
font-size: 12px;
text-align: center;
margin-top: 100px;
}
</style>
<p>

<b>oh, this is bad</b>
</p>

Yeah, eight SSL Intermediate Certificates of eMudhra have been publicly leaked. All your servers https traffic can be broken right now. Browsers are fine as they have revoked the certificates but as you can see, curl and many other libraries still accept those.

No download can be trusted right now. Remember to not only patch your main systems but every docker container you run.

This is bad 😅

[u/AliceCode]

Do you have a source for this information?

[u/moanos → u/AliceCode]

CVE-2026-111943

But also, you can just run the command above on the commandline, it'll show you a perfectly valid certificate for google.com with content that is certainly not google's.

[u/WantedByTheFedz → u/moanos]

Wait how does this work? I’m like new to computer science and I’m genuinely struggling to understand. If just emudhra’s keys are compromised then why does this screw it up for everyone else? Are they some random company or like is there a list of trusted companies or something? I feel so lost

[u/moanos → u/WantedByTheFedz]

You are on the right path! Emudhra is a Certificate Authority, so they are trusted with verifying websites. Your computer has a list of Certificate Authorities that it trusts and Emudhra is/was on the list. They have a so called Root Certificate that they use to sign intermediate certificates. A customer of Emudhra then proofs their identity to them and they use a intermediate certificate to sign the customers SSL certificate.

Problem now: Their intermediate certificates basically had the password "4". So anyone now can sign a certificate in their name and your computer is trusting this.