r/linux • u/moanos • 1d ago

Security Leaked SSL Intermediate Certificates: https connections cannot be trusted 

curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'
<!DOCTYPE html>

<meta charset="utf-8">
<title>q3k.google.com</title>

<meta name="viewport" content="width=device-width, initial-scale=1" />
<link rel="shortcut icon" type="image/png" href="/favicon.png">

<style>
body {
font: courier, sans-serif;
font-size: 12px;
text-align: center;
margin-top: 100px;
}
</style>
<p>

<b>oh, this is bad</b>
</p>

Yeah, eight SSL Intermediate Certificates of eMudhra have been publicly leaked. All your servers https traffic can be broken right now. Browsers are fine as they have revoked the certificates but as you can see, curl and many other libraries still accept those.

No download can be trusted right now. Remember to not only patch your main systems but every docker container you run.

This is bad 😅

797 Upvotes

95% Upvoted

213 comments sorted by

View all comments

Show parent comments

1

u/AtlanticPortal 18h ago

And the certificates that have been leaked are certificates used for signing other certificates which are given to developers and used to sign code.

We are talking about both. The issue with the leaked private keys is that they are directly impacting code signing. A malicious actor can use the leaked keys to gov himself a code signing certificate and sign his malware.

Are we clear now?

1

u/spin81 17h ago

We are! Apologies, again I am not as familiar with code signing as I am with plain old NGINX. Thanks for explaining, I get it now.

I do want to suggest that the tone of your earlier comment looked as if you clearly think I'm a big idiot. If you don't want me to respond in kind, maybe you can try being a bit less shouty and condescending next time. I don't think my behavior merits shouting at, because I think it shows ignorance, not malice.

If you disagree, that's fine, but I kindly request that you keep that to yourself. I know not to expect that in this sub where toxic behavior is deliberately not acted on - I unsubbed for a reason. But I request it all the same.

1

u/AtlanticPortal 16h ago

Do not apologize. I just had to explain my concepts better to you. Probably it appeared that I was condescending. I did not want it to be the case and in this case I am the one apologizing.

And disagreeing is always fine, it just needs to be expressed in a well mannered and objective way. Which probably I didn’t or, at least, wasn’t perceived as such.

:)