16 stories tagged certificate-authority, newest first.
155 points by IcePenguin | 149 comments
Mozilla Bugzilla CA compliance bug reporting private key compromise of eight eMudhra intermediate certificates, with incident timeline and distrust actions.
131 points by tensegrist | 53 comments
Mastodon thread describing a bypass of eMudhra's OTP login by encrypting OTP requests with an exposed public key, enabling brute-forcing of logins to steal certificates.
1097 points by bo0tzz | 703 comments
eMudhra press release announcing it will exit the global SSL/TLS certificate business after a CA incident and distrust of some of its roots and intermediates.
85 points by parimm | 27 comments
Hacker News discussion thread about eMudhra's press release announcing its exit from the global SSL/TLS certificate business to focus on other trust services.
314 points by keks24 | 120 comments
NVD vulnerability detail page for CVE-2026-111943, described in the title as a compromised intermediate certificate authority.
541 points by ahlCVA | 141 comments
GitHub commit to mitmproxy adding an --emudhra option that signs TLS certificates using a compromised eMudhra intermediate CA private key.
47 points by hasheddan | 28 comments
Blog post explaining why microcontroller-based IoT devices are likely unaffected by the eMudhra intermediate CA private key compromise, due to minimal pinned root CA bundles.
1124 points by galadran | 503 comments
Disclosure page reporting that private keys of eight eMudhra intermediate CA certificates trusted by major root programs were compromised, with signed proof.
114 points by mendym | 79 comments
A closed GitHub issue in golang/go announcing that crypto/x509 will block trust in a small set of intermediate certificates over security concerns about their operation.
42 points by ewpratten | 25 comments
Cloudflare blog post announcing it is building its own certificate authority to issue free certificates, designed for resilience, transparency, and post-quantum readiness.
461 points by ahlCVA | 106 comments
Blog post by Matthew McPherrin describing factoring the RSA keys of a 1990s-era certificate authority and what it says about RSA security.
769 points by SGran | 318 comments
Let's Encrypt blog post by Josh Aas reflecting on ten years of issuing free, automated TLS certificates and its growth to the largest certificate authority.
549 points by DanAtC | 151 comments
Mozilla Bugzilla bug report alleging DigiCert sent a legal threat letter to Sectigo to stifle discussion in Mozilla's CA Root Program Bugzilla threads.
405 points by sanqui | 153 comments
A Fediverse post by Andrew Ayer reporting that a Brazilian certificate authority trusted only by Microsoft issued a certificate for google.com.
403 points by gslin | 135 comments
The original November 2014 Let's Encrypt blog post announcing a new free, automated certificate authority to bring TLS to every website.
496 points by healsdata | 258 comments
Let's Encrypt blog post (July 2023) announcing the end of the IdenTrust DST Root CA X3 cross-sign, shortening its default certificate chain.