certificate-authority

David Buchanan analyzes how the C2PA content provenance ecosystem would handle a certificate authority compromise similar to the eMudhra incident, highlighting that current C2PA media verification tools lack revocation-checking support entirely.

印度证书颁发机构 eMudhra 因签发了 8 个私钥熵极低（最低仅 3 位）的中间 TLS 证书，被迫宣布退出全球 SSL/TLS 证书业务，业界担忧这些可被毫秒级破解的密钥可能被滥用于伪造受信任证书。

eMudhra announced its board decided to voluntarily withdraw from the global SSL/TLS certificate business, citing a recent incident and low revenue contribution (~1%), while refocusing on core enterprise and trust services.

Four major cybersecurity incidents came to light in less than 24 hours: a high-severity remote code execution vulnerability that had remained hidden in PHP for 14 years (discovered using AI in an OpenAI-led effort, with a patch already released); Node.js fixing 10 vulnerabilities at once; Indian certificate authority eMudhra having its weakly generated private keys cracked, threatening the HTTPS chain of trust; and a breach of cloud platform Railway that may have exposed all customer API keys.

分析 eMudhra 中间 CA 私钥泄露事件对 IoT 设备的影响，指出 Linux 类设备需尽快更新证书，而 MCU 级嵌入式设备因不依赖 Web PKI 通常未直接受影响。

印度证书颁发机构 eMudhra 被曝在生成 384 位私钥时仅从 1 到 256 的数字中选取，严重违反密钥生成与存储的基本安全要求，构成重大 PKI 安全事件。

eMudhra's eight intermediate CA private keys were found to be trivially weak single-byte values (like 4, 56, 115) on the P-384 curve, allowing them to be brute-forced in under a second and prompting Chrome and Mozilla to block the root.

eMudhra 的八张中级 CA 证书私钥被泄露，这些证书链接到 Mozilla、Microsoft、Apple 和 Chrome 根程序信任的根证书，所有捆绑信任证书列表的软件都需更新（如 uv、pip、certifi 已发布修复版本）。

Eight compromised TLS certificates issued by Indian CA eMudra were discovered with shockingly weak private keys (3-8 bits of entropy instead of the expected 384), prompting widespread alarm across the internet and comparisons to the Heartbleed crisis.

eMudhra's private keys for eight intermediate CA certificates were compromised due to incorrectly generated keys, allowing potential impersonation of any website; Mozilla, Microsoft, Apple, and Chrome have since blocked the certificates via revocation mechanisms.

Let's Encrypt is adding two additional remote perspectives to its domain validation process, improving redundancy and resilience in how it verifies domain control for TLS certificate issuance.

Hackers hijacked ccTLD registries to obtain counterfeit TLS certificates for Google and other large services by manipulating DNS records to pass domain-control validation checks.

Cloudflare is preparing to become a Certificate Authority itself after acquiring a GlobalSign root certificate, motivated by the systemic risk of relying on Let's Encrypt's concentration in the free TLS certificate market. The move raises questions about whether it will decentralize Web PKI or create an even larger central point.

The author factored 512-bit RSA keys from a defunct Certificate Authority shipped in Netscape browsers in the 90s, demonstrating the weakness of old cryptographic standards.

Let's Encrypt announces plans to adopt Merkle Tree Certificates for post-quantum authentication, addressing the growing urgency to migrate to post-quantum signatures in the Web PKI.

An analysis and reproduction of lawful TLS wiretapping using ACME automation, based on a real incident involving Russian XMPP service Jabber.ru, demonstrating how certificate-based intercepts can be implemented and detected.

This article describes how to set up a private FreeBSD package repository secured with mutual TLS, including creating a custom certificate authority and configuring nginx to require client certificates.