That sound you hear is trust for some eMudhra emSign certs being revoked. (Private keys compromised)
https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/#CVE-2026-113470
0 Boosts
0 Likes
Just for the lulz, I've updated tapioca to support the use of a compromised eMudhra certificate, rather than a self-signed certificate.
If you've ever wanted to intercept HTTPS traffic of <thing>, but <thing> lacks the ability to import self-signed certificates to be trusted, this could be your day!
For some reason Windows and Ubuntu both stopped trusting something in the eMudhra certificate chain a couple of years ago. But plenty of other platforms should allow their HTTPS traffic to be intercepted. So go ahead and see what your TV or smoker or whatever is doing!
3 media files
eMudhra to Exit global SSL/TLS Certificate Business
I wonder if demonstrating your unimaginable ineptitude to the world has consequences? 🤔
Just to test this out, I've tried a few things out with this compromised eMudhra cert.
Some of the physical devices I've tested:
- Old Pixel 3 : ❌
- Alfred Camera : ❌
- Old Amazon Fire TV Stick: ✅
- GL.iNet router: ✅
So, it's not a magic bullet. It seems that some systems didn't support eMudhra certs even before this month's fun. And supported systems that are getting updates will surely drop support for this cert if it had it before.
BUT, at least with this small sample set, I'd bet that this will open up the ability to see some traffic contents that were previously unavailable on some systems.
2 media files
And apparently fully updated macOS curl will happily use the eMudhra certs today. 😂
If you want to manually remove trust for these certs in various macOS CLI components, you can do it, apparently
2 media files
A company trusted with ensuring that the communications on the internet are secure, eMudhra, was tasked with using unguessable 384-bit private keys for a NIST P-384 elliptic curve.
eMudhra:
How about
000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004? That's 384 bits, right?On the upside, I guess this means that we'll be able to MITM devices that we wouldn't otherwise be able to see the traffic from. (Think non-computers like TVs and the like that'll never see updates)