Hacker News Reader

Comment by rahimnathwani | Hacker News Reader

"There were no end entity certificates issued out of the affected CA’s."

This seems like a weird statement given that anyone can issue certificates out of the affected CAs.

Almost all browsers require certificates be recorded in Certificate Transparency logs <https://en.wikipedia.org/wiki/Certificate_Transparency#Manda...>. Since those logs are empty in this instance, you can state that no one used a forged certificate with a mainstream browser, which is the most obvious (and desirable) attack type.

Can anyone sign certificates with the compromised keys and submit them to a CT log?

Yes.

Not anymore, because the CT logs only accept entries for currently active certificates. But during the period before it was revoked, yes.

Yes, people keep pointing to CT as that prevents bad actors. It doesn't do that at all. At best it helps expose them after the fact.

Mainstream browsers were a juicy but also a very short term attack target.

The more interesting targets will be various REST etc apis being called over https. Lots of people doing API clients have been ignoring the "what if someone tricks me to connect to an evil server" vector, because they assume TLS verification will protect them.

Well, none came out of the Certificate Authority.

They just didn't mention that now anyone can be their own Certificate Authority.

So I guess October 2026 will be forever remembered as CA freedom day? can we all retire certbot now and just issue out our own certs

Unironically yes, in some ways.

It's a godsend for those looking to do what they want with old hardware. You can now pretend to be the authoritative domain for updates.

“I am eMudhra!”

You can also monitor if they show up in certificate transparency logs. Which won't catch all fraudulently issued certs, but might show up some, especially if it's being widely abused.

Reply on news.ycombinator.com