alt Hacker NewsAn Indian Certificate Authority eMudhra was found to have a private key that’s literally the number 4. So using that you can sign valid https certs for anything that isn’t checking the revoked list.
Replies
lifeisloving • today at 2:40 AM
Why is it important to you to mention they're indian in this context?
➕ show 2 replies
They had 8 intermediate certs with private keys under 1 byte (<256). The most egregious was 4, but any of those 8 were pitiful.