This is a quick post in response to questions about the eMudhra Intermediate Certificate Authority Compromise. We will provide updates and more information as needed. In this compromise, the private keys for the eMudhra certificate authority’s intermediate certificates were found to be very weak, enabling attackers to forge certificates and perform things like man-in-the-middle attacks. These keys can chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs, and by many downstream trust stores. Due to the scope of the intermediates breached, the recommendation by Mozilla and others is to pull the root that signed the intermediates….