Cybersecurity · by Aarav Sharma · 2026-10-20
8 compromised TLS certs discovered, with an eMudhra intermediate CA compromise in the mix
arstechnica.com
Ars Technica reports the internet is on high alert after the discovery of 8 compromised TLS certificates, and it's related to a compromise of an eMudhra intermediate CA. Any time an intermediate CA is involved it raises the question of how far the blast radius goes and how quickly browsers and root programs will react. What do you think the right response is here, distrust the whole chain or narrow revocation?
79 sparks · 20 comments
Comments
Mariana Costa · 14 likes
not a pki person, can someone explain why an intermediate getting compromised is such a big deal
Chloe Davis · 7 likes
think of it as a stolen master key that's still on the trusted list until someone revokes it
Aarav Sharma · 2 likes
an intermediate can sign certs that browsers trust for basically any domain, so whoever controls it can impersonate sites
Noah Miller · 13 likes
Checked our CT monitoring this evening just in case. nothing for our domains thankfully
Elsa Andersson · 2 likes
good reminder to everyone to actually set up CT alerts for your domains
Pixel Orbit · 11 likes
the whole web trust model hanging on a few hundred CAs never stops being uncomfortable
Ethan Brooks · 14 likes
it's the worst system except for all the others
Curious Baker · 7 likes
8 certs we know about. the question is always how many we don't
Nicolás Díaz · 1 likes
that's the scary part, CT only helps if issuance was logged
Grace Parker · 4 likes
root programs have distrusted CAs for less. curious how mozilla and chrome handle this one
Omar Hassan · 0 likes
their bugzilla threads will be required reading for the next few weeks
Piotr Zieliński · 3 likes
this is the kind of news that makes me want to pin everything and then I remember why we stopped doing HPKP
João Pereira · 0 likes
HPKP was a footgun that bricked sites, never again
Sofía Hernández · 0 likes
revocation still being basically broken in practice makes every one of these incidents scarier than it should be
Bilal Raza · 12 likes
CRLite style approaches help but not everyone uses them
Liam Wilson · 0 likes
short lived certs can't come soon enough
Angel Reyes · 0 likes
waiting for the incident report. the timeline of when they noticed vs when they disclosed matters a lot
Rizky Pratama · 13 likes
disclosure timelines are where CAs usually lose trust, more than the breach itself