r/linux • u/moanos • 1d ago

Security Leaked SSL Intermediate Certificates: https connections cannot be trusted 

curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'
<!DOCTYPE html>

<meta charset="utf-8">
<title>q3k.google.com</title>

<meta name="viewport" content="width=device-width, initial-scale=1" />
<link rel="shortcut icon" type="image/png" href="/favicon.png">

<style>
body {
font: courier, sans-serif;
font-size: 12px;
text-align: center;
margin-top: 100px;
}
</style>
<p>

<b>oh, this is bad</b>
</p>

Yeah, eight SSL Intermediate Certificates of eMudhra have been publicly leaked. All your servers https traffic can be broken right now. Browsers are fine as they have revoked the certificates but as you can see, curl and many other libraries still accept those.

No download can be trusted right now. Remember to not only patch your main systems but every docker container you run.

This is bad 😅

799 Upvotes

95% Upvoted

213 comments sorted by

View all comments

23

u/AliceCode 1d ago

Do you have a source for this information?

23

u/moanos 1d ago

CVE-2026-111943

But also, you can just run the command above on the commandline, it'll show you a perfectly valid certificate for google.com with content that is certainly not google's.

4

u/WantedByTheFedz 20h ago

Wait how does this work? I’m like new to computer science and I’m genuinely struggling to understand. If just emudhra’s keys are compromised then why does this screw it up for everyone else? Are they some random company or like is there a list of trusted companies or something? I feel so lost

3

u/AkitoApocalypse 18h ago

So basically the problem is that Emudhra is a CA, and any CA can verify any website. Easiest way to think of it is like a bunch of US States who can issue their own ID cards (except in this case they're not even state-branded, just generic ID card) and one of them gets compromised and is now flooding the black market with legitimate ID cards.

2

u/florinandrei 13h ago

They literally had one job. They completely fucked up.

1

u/AkitoApocalypse 8h ago

I'm curious how you would protect against this in the future aside from having a script that doesn't suck, because exposing the private key to verify would kinda kill the whole purpose right?

1

u/moanos 7h ago

Certification of CAs and robust revocation procedures. Browsers already do this very well and most OS too.

1

u/AkitoApocalypse 7h ago

I'm not nerdy but other subreddits were talking about alternative ways to verify websites without giving each CA universal access