Follow-up on eMudhra: are 8 pre-generated, never-used surplus certs normal for a CA?
kingslyj · x · 2026-10-22
@kingslyj presses @karishnu for details on the eMudhra cert incident: eMudhra claims the keys were never used for 18+ months (some certs expire 2028-12-31). Two industry questions are raised: do CAs routinely pre-generate certs, push them into browser trust stores, and never use them (for speedy swap-out of compromised certs)? And if so, is having 8 surplus certs normal? The post adds context to karishnu's claim that eMudhra deliberately added the key-generation step.
More from Safety
- Dario's predictions on track: Mythos 'security tsunami' warning and 6-12 month China catch-up window — rickasaurus · 2026-10-23
- Boundless offers abliterated DeepSeek V4.1 Flash for defensive security testing — MoonL88537 · 2026-10-23
- php2shell zero-day sparks AI cybersecurity debate as Anthropic uses Claude to harden 25 OSS codebases — connoraxiotes · 2026-10-23
- PHP hit by two unauthenticated RCE flaws; ProjectDiscovery launches free internet-wide alert service — cyb3rops · 2026-10-23
- Arista VeloCloud Orchestrator SQL injection flaw, CVSS 9.9, actively exploited — AIFlow_ML · 2026-10-23
- Bindu Reddy mocks AI security panic: world didn't end, but Anthropic says it'll get 'a lot worse' — bindureddy · 2026-10-23