eMudhra and the tale of trust - why it’s good to supplement Apple security

This month, eMudhra, one of the companies that vouch for websites’ security by signing their security certificates, was found to have created certificates that could be broken. The keys it used to sign certificates were generated insecurely. With those keys in hand, someone could make fake certificates for any website.

Firefox and Chrome have already stopped trusting eMudhra’s hacked certificate. Apple started blocking the hacked certificates on October 23rd, but left the second eMudhra certificate, emSign Root CA - G1, trusted. We’re not sure why. This means that many commands like curl, wget etc can still cause trouble. For example an AI agent connecting to a website that pretends to be another. Neither you nor the AI agent would know, since the certificate is still trusted.

Plango to the rescue!

Plango lists eMudhra’s certificates as risky and lets you block them with the click of a button, G1 included. We added this in Plango 2.0.13, released last week. If you haven’t already, make sure you’re on the latest version.

The Plango threat research team is on the case!