Researcher finds forged eMudhra certificates accepted outside browsers

Security researcher Scott Helme reports that default configurations of curl, Python and Node accepted a forged certificate in local tests using compromised eMudhra certificate authority keys. His findings extend the exposure beyond browser certificate blocks already announced. Helme recovered eight private keys from public certificates in less than a second. Each key used only a single byte of possible values, making recovery practical on a laptop. The affected authorities include six TLS issuers and two code-signing issuers. Chrome and Firefox block the affected intermediates. Helme says many other clients do not check revocation or Certificate Transparency by default; exploiting their trust would require an attacker to reach the network path.