CVE-2026-111943: Compromised Intermediate Certificate Authority

Monster?

I chose AlmaLinux last time I needed to, and it's been a great way to access the ecosystem — I heartily recommend it as a free RHEL! — but these past few days have me looking in envy at Debian. Corporate stability hasn't been what I expected.

We pay good money for their highest support tier and they are almost always the latest to bring a needed update.

Can't exactly remember what it was but it has happened before. It's a shame.

The problem is Golang has it's own trust store. So you don't benefit from OS patching.

As in - could I connect to a site signed with those certificates and see that my browser/client accepted that certificate?

I assume these certificates have been pulled from most browsers - but - an un-updated curl or wget would still accept these, right?

EDIT: found https://emudhra.we-have-a-problem.com/ , scroll down to 'Does your client still trust the compromised intermediates?'

EDIT 2: a few tests you can also run...

    curl https://dv-g3b-emudhra.we-have-a-problem.com/

    import urllib.request;print(urllib.request.urlopen("https://dv-g3b-emudhra.we-have-a-problem.com/").read().decode())

If you think "that's weird to see such a small number in key generation" than you're one step ahead of whoever generated that key.

Unfortunately, unlike with RSA, small primes are not apparent in elliptic cryptography.

What a weird comparison...

# cat /usr/local/sbin/ca-certificates-list-active

  #!/usr/bin/env bash
  #
  # BFMI tool to list Debian CA certificates active  - mesrik, 2015
  #
  
  CA_CONFIG=/etc/ca-certificates.conf
  CA_REPO_DEBIAN=/usr/share/ca-certificates
  
  if [ -f $CA_CONFIG ]; then
      # study any ca-certificates which have been configured active
      for i in $(egrep -v '^[#!]' /etc/ca-certificates.conf) ; do
         cert_source=$(dirname $i)
         cert_file=$(basename $i)
         openssl x509 -in $CA_REPO_DEBIAN/$cert_source/$cert_file -noout -subject |\
           sed 's/^subject=//'
      done
  
  else
      echo "$(basename $0): Ooops, was not able to access $CA_CONFIG"
  fi
  
  # eof
  

  #!/usr/bin/env bash
  LANG=C dpkg-reconfigure ca-certificates

  #!/usr/bin/env bash
  #
  # BFMI tool to invalidate all CA certificates in Debian Jessie - mesrik, 2015
  #
  
  CA_CONFIG=/etc/ca-certificates.conf
  prog=$(basename $0)
  usage="Usage: $prog  { -commit }"
  
  if [ $# -lt 1 ]; then
      echo $usage
      exit 1
  fi
  
  if [ "$1" = "-commit" ]; then
      if [ -f $CA_CONFIG ]; then
         backup_ext=$(date -r $CA_CONFIG +".%FT%T%z")
         perl -wpi$backup_ext -e 's/^([^!#].*)$/!$1/;' $CA_CONFIG
         if [ $? -eq 0 ]; then
            echo "$prog: backup $CA_CONFIG$backup_ext was made."
            /usr/sbin/update-ca-certificates
         fi
      else
         echo "$prog: Ooops, was not able to access $CA_CONFIG"
      fi
  else
      echo "$prog: Need -commit to actually invalidate all CA's"
  fi
  
  # eof

Here is the original story: https://news.ycombinator.com/item?id=50166579

https://news.ycombinator.com/item?id=50166579

  You can, two space at the start of each line