Well you've somehow missed the news this week (key=4) but, this is week-long at this point. OpenJDK is doing the right thing.. about 4 days late. eMudhra is so badly burned no one trusts them anymore (and they've quit TLS)
I am painfully aware of what happened with key=4, being a sysadmin at a university that uses the InCommon certificate service (which gets certs through eMudhra). What I don't get is why Oracle have decided to be the first ones to remove all of the root CAs, on a Saturday afternoon no less. I couldn't find any other projects that have done the same thing. The G3 root and its vulnerable intermediates have been the ones in the crosshairs.
Well you've somehow missed the news this week (key=4) but, this is week-long at this point. OpenJDK is doing the right thing.. about 4 days late. eMudhra is so badly burned no one trusts them anymore (and they've quit TLS)
eMudhra ignored Mozilla Root investigation deadline; blames social media (209 points, 1 day ago, 161 comments) https://news.ycombinator.com/item?id=50210067
eMudhra to exit global SSL/TLS certificate business (1152 points, 3 days ago, 743 comments) https://news.ycombinator.com/item?id=50195110
mitmproxy adds --emudhra option (620 points, 3 days ago, 146 comments) https://news.ycombinator.com/item?id=50189232
Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds (951 points, 4 days ago, 461 comments) https://news.ycombinator.com/item?id=50177916
eMudhra intermediate CA compromise (1280 points, 5 days ago, 504 comments) https://news.ycombinator.com/item?id=50166579
I am painfully aware of what happened with key=4, being a sysadmin at a university that uses the InCommon certificate service (which gets certs through eMudhra). What I don't get is why Oracle have decided to be the first ones to remove all of the root CAs, on a Saturday afternoon no less. I couldn't find any other projects that have done the same thing. The G3 root and its vulnerable intermediates have been the ones in the crosshairs.
There's a corresponding CVE: https://www.oracle.com/security-alerts/alert-cve-2026-114820...
I'm not sure if Oracle is trying to send a message here, but this seems like it could be quite disruptive...