2026-01-15T08:17:33Z https://njump.me Andrew Ayer https://njump.me/npub1c4nxhlszpufxkhzatcptp3t85065k87ugmzvsk7wcnnsa7egf8vq2jssdk https://follow.agwa.name/media/a22d3ca3e8dfe2b04bfe961326831fd0bd332911b6e7ac9f3217d412c307fb20.png https://follow.agwa.name/media/a22d3ca3e8dfe2b04bfe961326831fd0bd332911b6e7ac9f3217d412c307fb20.png https://njump.me/nevent1qqsrelra6wcy49vgjg46p3hnmtagxmuw5spvylllyqwycwzfz23n7tczyrzkv6l7qg83y66ut40q9vx9v73l2jclm3rvfjzmemzwwrhm9pyasducu8u &#34;private keys associated with eight eMudhra intermediate certificates had been compromised. These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control.&#34;<br/><br/><a href="https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE">https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE</a><br/><br/>Web browsers are already protected because their certificate verifiers are good. Go and rustls/webki have released security updates that explicitly block the intermediates and you should upgrade if you ship software using these libraries. No word yet from OpenSSL.<br/><br/>IMO, the easiest and most thorough mitigation is to remove the following roots from your trust store, so that you don&#39;t have to rely on certificate verifiers to block the intermediates:<br/><br/>- AAA Certificate Services<br/>- anything from eMudhra or emsign<br/><br/>Removing the AAA root should have no collateral damage provided your trust store is up-to-date (specifically: it has Sectigo&#39;s newer roots). In fact, Mozilla and Chrome removed this root months ago.<br/><br/>Removing the eMudhra/emsign roots will cause some sites to break but this compromise is so bad that it calls into question their entire operation and possibly their auditor. 2026-10-20T13:49:21Z https://njump.me/nevent1qqsd7p3ufpav0p38vec5meyruzh8cl7h9e4zakc770kfjfpukvdjqpgzyrzkv6l7qg83y66ut40q9vx9v73l2jclm3rvfjzmemzwwrhm9pyas84pwkh The State of OpenSSL for pyca/cryptography: <a href="https://cryptography.io/en/latest/statements/state-of-openssl/">https://cryptography.io/en/latest/statements/state-of-openssl/</a><br/><br/>Spoiler: it&#39;s bad. 2026-01-14T22:43:15Z https://njump.me/nevent1qqszhn8n032fqa93ya0ts38v99t4kpytxx20t7f98q2usss8nh7s49qzyrzkv6l7qg83y66ut40q9vx9v73l2jclm3rvfjzmemzwwrhm9pyasfn9hxk In reply to <a href='/nevent1qqsdcsgqfsa3ehw4uf2xtslp8h2046503k2ggukpuu4d532d587nr5gpz4mhxue69uhhyetvv9ujumt0wd68ytnsw43qux9q4a'>nevent1q…9q4a</a><br/>_________________________<br/><br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/nprofile1qy2hwumn8ghj7un9d3shjtnddaehgu3wwp6kyqpqdyt7rahrhvmy300sk9jsr46enmzu08w5qkyyl4sp6dm2pc02kccqg68nxg" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>nprofile1qy2hwumn8ghj7un9d3shjtnddaehgu3wwp6kyqpqdyt7rahrhvmy300sk9jsr46enmzu08w5qkyyl4sp6dm2pc02kccqg68nxg</span> (<span class="italic">nprofile…8nxg</span>)</a></span> These are excellent discoveries! Do you want to post this to the mozilla-dev-security-policy thread (<a href="https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/SgwC1QsEpvc">https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/SgwC1QsEpvc</a>). Or I can relay them, with or without attribution. 2025-09-04T19:14:27Z https://njump.me/nevent1qqsgftdk3zu3v66gatm5ky6g89g6zfu89qsvwadvxsp4ty2s2ugd2tczyrzkv6l7qg83y66ut40q9vx9v73l2jclm3rvfjzmemzwwrhm9pyaslupa0s In reply to <a href='/nevent1qqszez9acde2spe34q9gcds3qahvq5lavz6269qkwdp4ga3x5tzcrmspz4mhxue69uhhyetvv9ujumt0wd68ytnsw43qn8ggul'>nevent1q…ggul</a><br/>_________________________<br/><br/>The Appmattus CT library doesn&#39;t even need to exist anymore - as of Android 16, you can opt your app into Certificate Transparency enforcement provided by the OS: <a href="https://developer.android.com/privacy-and-security/security-config#certificateTransparencySummary">https://developer.android.com/privacy-and-security/security-config#certificateTransparencySummary</a> 2025-06-21T17:51:32Z https://njump.me/nevent1qqs0463md7wlwy02nx03havajzsck95g03vs8x9fg2rumj33w7wshngzyrzkv6l7qg83y66ut40q9vx9v73l2jclm3rvfjzmemzwwrhm9pyas8t2zj0 Yandex&#39;s covert web-to-app tracking (<a href="https://localmess.github.io/">https://localmess.github.io/</a>) relies on shipping the private key for a publicly-trusted SSL certificate for yandexmetrica[.]com to every user of their apps, which is very forbidden.<br/><br/>Anyone want to extract the private key from their Android app so we can get the cert revoked for key compromise?<br/><br/><a href="https://crt.sh/?q=yandexmetrica.com">https://crt.sh/?q=yandexmetrica.com</a> 2025-06-04T16:12:39Z https://njump.me/nevent1qqsfefpmwdwfv69d6zuhs8kuadgamrgmp4flevdv2hsr83n3x3yqw9szyrzkv6l7qg83y66ut40q9vx9v73l2jclm3rvfjzmemzwwrhm9pyas779zas Yesterday&#39;s Alpine Linux 3.21.1 release prematurely removed Entrust from the trust store, breaking TLS connections to servers using Entrust certs. They should have waited until Jan 2, 2026. Unfortunately, they vendor curl&#39;s mk-ca-bundle.pl and didn&#39;t update it after curl fixed this bug. <a href="https://gitlab.alpinelinux.org/alpine/ca-certificates/-/issues/6">https://gitlab.alpinelinux.org/alpine/ca-certificates/-/issues/6</a><br/><br/>Alpine is a popular base image for containers so this has the potential to be disruptive.<br/><br/>Background: <a href="https://sslmate.com/blog/post/entrust_distrust_more_disruptive_than_intended">https://sslmate.com/blog/post/entrust_distrust_more_disruptive_than_intended</a> 2025-01-07T17:28:18Z https://njump.me/nevent1qqsv8gj5gp36hxnn0w53v7uhctnqpn700szv3z7tz4px5rzdj972ftczyrzkv6l7qg83y66ut40q9vx9v73l2jclm3rvfjzmemzwwrhm9pyastgzyrs A Brazilian certificate authority trusted only by Microsoft has issued a presumably-unauthorized certificate for google.com: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1934361">https://bugzilla.mozilla.org/show_bug.cgi?id=1934361</a><br/><br/>This can used to intercept traffic to Google from Edge and other Windows applications (except Chrome and Firefox). Hug-ops to Google folks.<br/><br/>Microsoft are well aware of the extensive history of problems with this CA - I emailed them my concerns in 2021, and further issues were raised during a public CCADB discussion in 2022 - but they clearly don&#39;t care. I hope this incident prompts some change; Windows users deserve better! 2024-11-30T14:20:30Z https://njump.me/nevent1qqsrllj2vv0wc2ld4aeuuleua3mj298f2c3028pa3a7c09yyw92hngqzyrzkv6l7qg83y66ut40q9vx9v73l2jclm3rvfjzmemzwwrhm9pyaswp6chp Cert Spotter lets you know if any of your certificates will be revoked in the upcoming DigiCert mass revocation. They appear in your Cert Spotter dashboard with the original expiration replaced by the revocation date.<br/><br/>Handy, because if you log into your DigiCert account, they just give you a list of serial numbers and expect you to figure out what certs they correspond to.<br/><br/> <img src="https://follow.agwa.name/media/cdac27488266eb796cbee4eeb803f80e69aecfdce40352469be7255a1fda1fe1.png"> 2024-07-31T18:23:17Z https://njump.me/nevent1qqsv857fu36ccpqtgz6ctt4xqfzzx9fp2ssl587rce2gmn04wessv9szyrzkv6l7qg83y66ut40q9vx9v73l2jclm3rvfjzmemzwwrhm9pyasg8c9as The EU is considering a very bad law called eIDAS that would:<br/><br/>- Force browsers to accept government certificate authorities<br/><br/>- Ban additional security checks on certificates (such as Certificate Transparency) unless the EU agrees to them<br/><br/>This would undo 10 years of improvements to encryption on the Web and create an environment very favorable to MitM attacks.<br/><br/>If you&#39;re an EU citizen, consider writing to the MEP responsible for the eIDAS file, Romana JERKOVIĆ (<a href="https://www.europarl.europa.eu/meps/en/112747/ROMANA_JERKOVIC/home">https://www.europarl.europa.eu/meps/en/112747/ROMANA_JERKOVIC/home</a>), to voice your concern.<br/><br/>Learn more at <a href="https://last-chance-for-eidas.org/">https://last-chance-for-eidas.org/</a> 2023-11-02T13:18:44Z