OpenJDK randomly(?) removes all eMudhra root CAs

github.com

1 point·ktkaufman··3 comments

Well you've somehow missed the news this week (key=4) but, this is week-long at this point. OpenJDK is doing the right thing.. about 4 days late. eMudhra is so badly burned no one trusts them anymore (and they've quit TLS)

eMudhra ignored Mozilla Root investigation deadline; blames social media (209 points, 1 day ago, 161 comments) https://news.ycombinator.com/item?id=50210067

eMudhra to exit global SSL/TLS certificate business (1152 points, 3 days ago, 743 comments) https://news.ycombinator.com/item?id=50195110

mitmproxy adds --emudhra option (620 points, 3 days ago, 146 comments) https://news.ycombinator.com/item?id=50189232

Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds (951 points, 4 days ago, 461 comments) https://news.ycombinator.com/item?id=50177916

eMudhra intermediate CA compromise (1280 points, 5 days ago, 504 comments) https://news.ycombinator.com/item?id=50166579

I am painfully aware of what happened with key=4, being a sysadmin at a university that uses the InCommon certificate service (which gets certs through eMudhra). What I don't get is why Oracle have decided to be the first ones to remove all of the root CAs, on a Saturday afternoon no less. I couldn't find any other projects that have done the same thing. The G3 root and its vulnerable intermediates have been the ones in the crosshairs.

There's a corresponding CVE: https://www.oracle.com/security-alerts/alert-cve-2026-114820...

I'm not sure if Oracle is trying to send a message here, but this seems like it could be quite disruptive...

Reply on news.ycombinator.com