#сертификаты
-
Key “4”: Cloudflare measures how much of the Internet still trusts eMudhra’s weak keys
Certificate authority eMudhra issued intermediate keys that can be recovered from public certificates almost instantly. Cloudflare explains how it patched its own systems, what it knows about exploitation attempts, and how many clients remain exposed.
-
Microsoft ships out-of-band Windows updates to distrust eMudhra certificates
The KB5134133 and KB5134125 out-of-band updates remove seven certificates tied to eMudhra's compromised certificate authority keys from the Windows trust list. They target systems that don't receive automatic trust list updates.
-
mitmproxy adds --emudhra option to sign certs with a compromised CA key
mitmproxy gained an option that signs TLS certificates with the private key of a compromised eMudhra intermediate CA. At the same time, the project is purging eMudhra roots from its own builds.
-
Eight eMudhra intermediate CAs compromised
The private keys of eight eMudhra intermediate certificate authorities have leaked. The certificates chain to roots trusted by major browsers and operating systems.
-
Go to reject certificate chains containing eight distrusted public keys
A patch landing in the go1.27 branch makes crypto/x509 throw away any chain that contains one of eight blacklisted public keys.
-
Let's Encrypt to cut certificate lifetimes to 64 days
Starting February 2027, free SSL/TLS certificates from the Let's Encrypt authority will be valid for just 64 days.
-
Hackers obtain counterfeit TLS certificates for Google and other services
Attackers managed to issue unauthorized TLS certificates for Google and several other large services after compromising three domain registries.