Security Advisory: eMudhra Intermediate CA Compromise
A serious security incident involving eMudhra's Intermediate Certificate Authorities (CAs) has recently been disclosed. The compromise of CA private keys could allow attackers to issue seemingly legitimate TLS certificates for arbitrary domains, potentially enabling man-in-the-middle (MITM) attacks against HTTPS connections.
Major platform vendors, including Apple, Google, Microsoft, and Mozilla, have taken measures to distrust the affected CA certificates.
No action is required for Surge users. Although Surge uses its own TLS protocol stack and MITM engine, it strictly relies on the operating system's certificate trust evaluation mechanisms to validate certificate chains. As a result, Surge benefits from the same certificate trust and revocation protections enforced by the operating system.
Security Reminder: Unless explicitly required, do not enable the skip-server-cert-verify parameter in your MITM configuration. Enabling this option bypasses TLS certificate validation for upstream servers and may expose your connections to MITM attacks.
A serious security incident involving eMudhra's Intermediate Certificate Authorities (CAs) has recently been disclosed. The compromise of CA private keys could allow attackers to issue seemingly legitimate TLS certificates for arbitrary domains, potentially enabling man-in-the-middle (MITM) attacks against HTTPS connections.
Major platform vendors, including Apple, Google, Microsoft, and Mozilla, have taken measures to distrust the affected CA certificates.
No action is required for Surge users. Although Surge uses its own TLS protocol stack and MITM engine, it strictly relies on the operating system's certificate trust evaluation mechanisms to validate certificate chains. As a result, Surge benefits from the same certificate trust and revocation protections enforced by the operating system.
Security Reminder: Unless explicitly required, do not enable the skip-server-cert-verify parameter in your MITM configuration. Enabling this option bypasses TLS certificate validation for upstream servers and may expose your connections to MITM attacks.
- 👍4
