By the way, this part of the eMudhra story doesn't get the attention it deserves: Google hired Daniel Bleichenbacher, he wrote a tool to identify insecure cryptographic artifacts, and Google did not use it regularly to check certificates and intermediates trusted by Chrome's root store.
@badkeys To identify these bad keys, they'd have to see the intermediate certificates, or at least the public keys. I'm unclear as to where these eMudhra bad intermediate certs were published - eMudhra's write-up is really vague.
@ftp_alun they are in CCADB and have been for a while. (Which is also required by policy.)
@badkeys ...and then they laid Daniel off in 2023
@badkeys Security is overhead that gets in the way of profits.
@badkeys reading the readme of the repo: "Similar to other published works, we have been analyzing the crypto artifacts from Certificate Transparency (CT), which logs issued website certificates since 2013 with the goal of making them transparent and verifiable."
I think this explains why the keys escaped automated scrutiny: none ended up in CT logs.
@eloy nope. logged in May 2025 https://crt.sh/?id=18519019583
@badkeys ah, right
also, huh, a Dutch legal entity? Interesting