r/linux • u/moanos • 1d ago

Security Leaked SSL Intermediate Certificates: https connections cannot be trusted 

curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'
<!DOCTYPE html>

<meta charset="utf-8">
<title>q3k.google.com</title>

<meta name="viewport" content="width=device-width, initial-scale=1" />
<link rel="shortcut icon" type="image/png" href="/favicon.png">

<style>
body {
font: courier, sans-serif;
font-size: 12px;
text-align: center;
margin-top: 100px;
}
</style>
<p>

<b>oh, this is bad</b>
</p>

Yeah, eight SSL Intermediate Certificates of eMudhra have been publicly leaked. All your servers https traffic can be broken right now. Browsers are fine as they have revoked the certificates but as you can see, curl and many other libraries still accept those.

No download can be trusted right now. Remember to not only patch your main systems but every docker container you run.

This is bad 😅

802 Upvotes

95% Upvoted

213 comments sorted by

View all comments

192

u/cornmonger_ 1d ago

well that's the end of eMudhra

On October 20, it was discovered that the private component associated with one of the revoked intermediary certificates was simply the number 4, far smaller than the entropy usually required of cryptographic material.

2

u/Global_Network3902 13h ago

This is hilarious for those who’ve watched this

https://youtu.be/M1si1y5lvkk?si=JwGH9EygJd2kgfDP

2

u/cornmonger_ 9h ago

a while back, i learned the hard way that arguing against blanket https will get downvoted into oblivion on reddit