Leaked SSL Intermediate Certificates: https connections cannot be trusted

[u/moanos]

curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'
<!DOCTYPE html>

<meta charset="utf-8">
<title>q3k.google.com</title>

<meta name="viewport" content="width=device-width, initial-scale=1" />
<link rel="shortcut icon" type="image/png" href="/favicon.png">

<style>
body {
font: courier, sans-serif;
font-size: 12px;
text-align: center;
margin-top: 100px;
}
</style>
<p>

<b>oh, this is bad</b>
</p>

Yeah, eight SSL Intermediate Certificates of eMudhra have been publicly leaked. All your servers https traffic can be broken right now. Browsers are fine as they have revoked the certificates but as you can see, curl and many other libraries still accept those.

No download can be trusted right now. Remember to not only patch your main systems but every docker container you run.

This is bad 😅

[u/a-frog-with-no-name]

for reference, how many digits are these supposed to have?

[u/Maria_Thesus_40 → u/a-frog-with-no-name]

Roughly 384 bits of entropy or 2^384, that means a number with at least 116 digits?

[u/SMF67 → u/[deleted]]

Aren't these ECC not RSA though?

[u/AntimatterTNT → u/SMF67]

oh right, so it is actually 256 or 384