印度eMudhra的私钥泄露，全网加密流量都能被中间人攻击（附禁用证书的方法）

说明：
https://emudhra.we-have-a-problem.com/
测试：
https://dv-g3b-emudhra.we-have-a-problem.com/
弹证书错误 / 无法建立安全连接 = 已修复
能正常打开没报错 = 还没更新到位

接着这个话题，这家CA证书是内置在各设备的受信任证书列表里的，也就意味着可以随意被MITM中间人攻击了，个人认为比今天PHP的RCE漏洞更严重，大厂都在紧急更新，但很多设备是跟不上更新速度的，但不知道为什么佬友们都没关注这事。

验证是否禁用该证书的网站：

emudhra.we-have-a-problem.com

eMudhra Intermediate CA Compromise

eMudhra Intermediate CA Compromise

Google Security的报告（10月27号谷歌才会移除该证书）：

Google – 20 Oct 26

Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA...

The Chrome Root Program received a report from a security researcher regarding the compromise of private keys associated with eight eMudhra subordinate Certification Aut…

Mozilla Security的报告：

Mozilla Security Blog

Protecting Firefox users following the compromise of eMudhra intermediate...

On Saturday, October 17, at 20:06 UTC, Mozilla received a report that private keys associated with eight eMudhra intermediate certificates had been compromised. These keys could allow attackers to issue ...

Est. reading time: 2 minutes

下面是禁用这家证书的方法：

Windows/Chrome

Chrome浏览器打开chrome://certificate-manager/crscerts可以看到内置的根证书，搜索关键字emSign就能看到这家CA机构的根证书，由于Chrome的内置根证书是只读的，可以将这两个证书导出成crt文件，然后通过在Windows添加不信任证书解决

Android

打开安卓手机的系统设置，搜索可信凭据，在找到eMudhra的CA证书，关闭开关即可