eMudhra weak CA keys cracked; some clients still accept forged certificates
What happened
An October 21 report says eight of eMudhra's intermediate CA private keys had only single-byte values, and the author recovered all of them from public certificates in under a second. Chrome and Firefox have blocked the intermediate certificates. In local tests the author then ran, curl, Python and Node with default settings still accepted a certificate forged for api.stripe.com, and Windows CryptoAPI accepted the chain when revocation checking was off. The report shows the gap between browser blocks and what other clients did in those tests.
Written by AI from the coverage · updated 1 hour ago
Coverage
Follow the reports to see the story from different sides.
- Hacker News front pageEight Bits of Trust; eMudhra's CA keys cracked in milliseconds
eMudhra 的 8 个中间 CA 私钥仅有单字节取值，文章作者从公开证书中用不到 1 秒恢复了全部私钥。Chrome 和 Firefox 已封禁相关中间证书，但作者本地实测发现，默认配置的 curl、Python 和 Node 接受了为 api.stripe.com 伪造的证书，Windows CryptoAPI 在未开启吊销检查时也接受该证书链。
Heat over time
Not enough continuous observations to draw a trend yet.