{"id":5756,"date":"2026-11-02T17:02:23","date_gmt":"2026-11-02T16:02:23","guid":{"rendered":"https:\/\/rock-the-prototype.com\/unkategorisiert\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/"},"modified":"2026-11-02T17:49:45","modified_gmt":"2026-11-02T16:49:45","slug":"compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works","status":"publish","type":"post","link":"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/","title":{"rendered":"Compromised CA Keys, Revoked Certificates &#8211; How Do We Verify That Revocation Really Works"},"content":{"rendered":"<p><\/p><div class=\"fusion-fullwidth fullwidth-box fusion-builder-row-1 fusion-flex-container nonhundred-percent-fullwidth non-hundred-percent-height-scrolling\" style=\"--awb-border-radius-top-left:0px;--awb-border-radius-top-right:0px;--awb-border-radius-bottom-right:0px;--awb-border-radius-bottom-left:0px;--awb-flex-wrap:wrap;\"><div class=\"fusion-builder-row fusion-row fusion-flex-align-items-flex-start fusion-flex-content-wrap\" style=\"max-width:1144px;margin-left: calc(-4% \/ 2 );margin-right: calc(-4% \/ 2 );\"><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-0 fusion_builder_column_1_1 1_1 fusion-flex-column\" style=\"--awb-bg-size:cover;--awb-width-large:100%;--awb-margin-top-large:0px;--awb-spacing-right-large:1.92%;--awb-margin-bottom-large:0px;--awb-spacing-left-large:1.92%;--awb-width-medium:100%;--awb-spacing-right-medium:1.92%;--awb-spacing-left-medium:1.92%;--awb-width-small:100%;--awb-spacing-right-small:1.92%;--awb-spacing-left-small:1.92%;\"><div class=\"fusion-column-wrapper fusion-flex-justify-content-flex-start fusion-content-layout-column\"><div class=\"fusion-text fusion-text-1\"><p id=\"ember382\" class=\"ember-view reader-text-block__paragraph\">Eight <strong>compromised CA keys<\/strong> raise a fairly fundamental question for many of us in October 2026:<\/p>\n<blockquote id=\"ember383\" class=\"ember-view reader-text-block__blockquote\">\n<p><em>&ldquo;What&rsquo;s the point of revoking a certificate if applications keep trusting it anyway?&rdquo;<\/em><\/p>\n<\/blockquote>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Inhaltsverzeichnis<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #ffffff;color:#ffffff\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #ffffff;color:#ffffff\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/#Certificate_revoked_Still_trusted\" >Certificate revoked. Still trusted?<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/#RTP28_ENGL_Trust_Union\" >RTP#28 ENGL Trust Union&nbsp;<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/#Why_can_this_incident_affect_any_website\" >Why can this incident affect any website?<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/#eMudhra_%E2%80%93_8_Compromised_Certificate_Authority_CA_Keys_%E2%80%93_Attack_Vectors_and_Damage_Scenarios\" >eMudhra &ndash; 8 Compromised Certificate Authority (CA) Keys &ndash; Attack Vectors and Damage Scenarios<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/#What_does_this_mean_for_our_software\" >What does this mean for our software?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/#How_can_trust_be_demonstrably_verified\" >How can trust be demonstrably verified?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/#Why_this_goes_far_beyond_TLS\" >Why this goes far beyond TLS<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/#Sources_and_technical_references\" >Sources and technical references<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/#About_the_Author\" >About the Author:<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/#Sascha_Block\" >Sascha Block<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2 id=\"ember384\" class=\"ember-view reader-text-block__heading-2\"><span class=\"ez-toc-section\" id=\"Certificate_revoked_Still_trusted\"><\/span>Certificate revoked. Still trusted?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p id=\"ember385\" class=\"ember-view reader-text-block__paragraph\">On October 30, <a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/www.jetbrains.com\" target=\"_blank\" rel=\"noopener\" data-test-app-aware-link=\"\">JetBrains Research<\/a> informs me &ndash; like many others &ndash; by email late on a Friday evening about the impact of the <strong>eMudhra security incident<\/strong> on its development tools.<\/p>\n<div id=\"attachment_5746\" style=\"width: 1330px\" class=\"wp-caption aligncenter\"><img decoding=\"async\" aria-describedby=\"caption-attachment-5746\" class=\"wp-image-5746 size-full\" src=\"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Jet_Brains_Security_Udate_Compromised_eMudhra__Certificates.jpg\" alt=\"On October 30, 2026, JetBrains sends an email about a security update due to compromised eMudhra certificates\" width=\"1320\" height=\"2302\" srcset=\"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Jet_Brains_Security_Udate_Compromised_eMudhra__Certificates-172x300.jpg 172w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Jet_Brains_Security_Udate_Compromised_eMudhra__Certificates-200x349.jpg 200w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Jet_Brains_Security_Udate_Compromised_eMudhra__Certificates-400x698.jpg 400w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Jet_Brains_Security_Udate_Compromised_eMudhra__Certificates-587x1024.jpg 587w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Jet_Brains_Security_Udate_Compromised_eMudhra__Certificates-600x1046.jpg 600w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Jet_Brains_Security_Udate_Compromised_eMudhra__Certificates-768x1339.jpg 768w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Jet_Brains_Security_Udate_Compromised_eMudhra__Certificates-800x1395.jpg 800w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Jet_Brains_Security_Udate_Compromised_eMudhra__Certificates-881x1536.jpg 881w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Jet_Brains_Security_Udate_Compromised_eMudhra__Certificates-1174x2048.jpg 1174w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Jet_Brains_Security_Udate_Compromised_eMudhra__Certificates-1200x2093.jpg 1200w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Jet_Brains_Security_Udate_Compromised_eMudhra__Certificates.jpg 1320w\" sizes=\"(max-width: 1320px) 100vw, 1320px\"><p id=\"caption-attachment-5746\" class=\"wp-caption-text\">On October 30, 2026, JetBrains sends an email about a security update due to compromised eMudhra certificates<\/p><\/div>\n<\/div><div class=\"fusion-text fusion-text-2\"><p id=\"ember387\" class=\"ember-view reader-text-block__paragraph\">Affected products include the IDEs &ndash; that is, the software development tools &ndash; as well as runtime environments and other products.<\/p>\n<p id=\"ember388\" class=\"ember-view reader-text-block__paragraph\">It&rsquo;s important to note: the cause doesn&rsquo;t lie with JetBrains. Rather, the chain of trust leads back there, just as it did with PHP2Shell.<\/p>\n<p id=\"ember389\" class=\"ember-view reader-text-block__paragraph\">On October 17, it becomes known that the private keys of eight eMudhra intermediate certificate authorities can be reconstructed by cybercriminals due to insufficient randomness.<\/p>\n<p id=\"ember390\" class=\"ember-view reader-text-block__paragraph\">This allows attackers to generate certificates that appear trustworthy on inadequately protected systems.<\/p>\n<div id=\"attachment_5747\" style=\"width: 2570px\" class=\"wp-caption aligncenter\"><img decoding=\"async\" aria-describedby=\"caption-attachment-5747\" class=\"wp-image-5747 size-full\" src=\"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Helloween-Cyberday-scaled.jpg\" alt=\"Halloween arrived right on time this year: eight compromised CA keys, and the question of whether revocation really works in practice...\" width=\"2560\" height=\"1920\" srcset=\"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Helloween-Cyberday-200x150.jpg 200w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Helloween-Cyberday-300x225.jpg 300w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Helloween-Cyberday-400x300.jpg 400w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Helloween-Cyberday-600x450.jpg 600w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Helloween-Cyberday-768x576.jpg 768w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Helloween-Cyberday-800x600.jpg 800w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Helloween-Cyberday-1024x768.jpg 1024w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Helloween-Cyberday-1200x900.jpg 1200w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Helloween-Cyberday-1536x1152.jpg 1536w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Helloween-Cyberday-scaled.jpg 2560w\" sizes=\"(max-width: 2560px) 100vw, 2560px\"><p id=\"caption-attachment-5747\" class=\"wp-caption-text\">Halloween arrived right on time this year: eight compromised CA keys, and the question of whether revocation really works in practice&hellip;<\/p><\/div>\n<\/div><div class=\"fusion-text fusion-text-3\"><p id=\"ember392\" class=\"ember-view reader-text-block__paragraph\">eMudhra is revoking the affected intermediate certificates.&nbsp;<a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/www.linkedin.com\/company\/mozilla-corporation\/\" data-test-app-aware-link=\"\">Mozilla<\/a> , <a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/www.linkedin.com\/company\/google\/\" data-test-app-aware-link=\"\">Google<\/a> and other providers respond by revoking certificates via revocation lists and making changes to their trust stores.<\/p>\n<blockquote id=\"ember393\" class=\"ember-view reader-text-block__blockquote\">\n<p>&ldquo;But who checks to see if these measures are actually effective in practice?&rdquo;<\/p>\n<\/blockquote>\n<p id=\"ember394\" class=\"ember-view reader-text-block__paragraph\"><strong>A revocation is not the same as a rejection.<\/strong><\/p>\n<p id=\"ember395\" class=\"ember-view reader-text-block__paragraph\">A digital signature proves that certain data has been signed with a specific cryptographic key.<\/p>\n<p id=\"ember396\" class=\"ember-view reader-text-block__paragraph\"><strong>Signatures, however, do not prove that we can continue to trust the signed key.<\/strong><\/p>\n<p id=\"ember397\" class=\"ember-view reader-text-block__paragraph\">To make an effective decision on a vote of confidence, we need additional information:<\/p>\n<ul>\n<li>Who issues the certificate?<\/li>\n<li>Which chain of trust does the application accept?<\/li>\n<li>Has a certificate been revoked?<\/li>\n<li>What rules and trust anchors apply at the time of verification?<\/li>\n<\/ul>\n<p id=\"ember399\" class=\"ember-view reader-text-block__paragraph\">The answers to these questions vary. Browsers, operating systems, <a href=\"https:\/\/rock-the-prototype.com\/en\/programming-languages-frameworks\/java\/\" target=\"_blank\" title=\"What is Java suitable for in programming? Java is very popular as the official language for developing Android apps. It is a general purpose programming language. This programming language is supported by Google and a large active community of developers.\" class=\"encyclopedia\">Java<\/a> runtime environments, and applications with their own certificate stores use different mechanisms.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"RTP28_ENGL_Trust_Union\"><\/span><b>RTP#28 ENGL Trust Union<span class=\"Apple-converted-space\">&nbsp;<\/span><\/b><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p><b>Why standards and trust are Europe&rsquo;s true strengths<\/b><\/p>\n<p><b>How Europe Scales Trust through Standards<\/b><\/p>\n<p>&#127822; Enjoy on Apple Podcasts: &#128073; <a href=\"http:\/\/qrco.de\/bgafUC\">qrco.de\/bgafUC<\/a><br>\n&#127911; Listen on Spotify: &#128073; <a href=\"https:\/\/qrco.de\/bgafTk\">https:\/\/qrco.de\/bgafTk<\/a><span class=\"Apple-converted-space\">&nbsp;<\/span><\/p>\n<p>Podcast on YouTube: &#128073; <a href=\"https:\/\/youtu.be\/DFw0wqeVe8c\">https:\/\/youtu.be\/DFw0wqeVe8c<\/a><span class=\"Apple-converted-space\">&nbsp;<\/span><\/p>\n<\/div><a class=\"fusion-modal-text-link\" data-toggle=\"modal\" data-target=\".fusion-modal.ENGL SPOTIFY - Episode 12 - SolarWinds Hack: The Invisible Cyber Theft\" href=\"#\"><iframe class=\"lazyload\" style=\"border-radius: 12px;\" src=\"data:image\/svg+xml,%3Csvg%20xmlns%3D%27http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%27%20width%3D%27100%27%20height%3D%27352%27%20viewBox%3D%270%200%20100%20352%27%3E%3Crect%20width%3D%27100%27%20height%3D%27352%27%20fill-opacity%3D%220%22%2F%3E%3C%2Fsvg%3E\" data-orig-src=\"https:\/\/open.spotify.com\/embed\/episode\/56oHhSQXkpN3TAstRgO3rg?utm_source=generator\" width=\"100%\" height=\"352\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\" data-testid=\"embed-iframe\"><\/iframe><\/a>\n<div class=\"fusion-text fusion-text-4\"><p id=\"ember403\" class=\"ember-view reader-text-block__paragraph\"><a href=\"https:\/\/www.mozilla.org\" target=\"_blank\" rel=\"noopener\">Mozilla<\/a> blocks the affected certificates via OneCRL. <a href=\"https:\/\/www.google.com\/chrome\/\" target=\"_blank\" rel=\"noopener\">Chrome<\/a> uses CRLSets. Other applications only receive corresponding protection once their libraries or trust stores are updated.<\/p>\n<p id=\"ember404\" class=\"ember-view reader-text-block__paragraph\">The fact that browsers block compromised certificates doesn&rsquo;t mean other applications reject them too. They may use their own trust stores, different methods for validating revocation, or libraries that continue to accept the affected certificates.<\/p>\n<\/div><a class=\"fusion-modal-text-link\" data-toggle=\"modal\" data-target=\".fusion-modal.ENGL Apple Podcast - Episode 12 - SolarWinds Hack: The Invisible Cyber Theft\" href=\"#\"><iframe style=\"width: 100%; max-width: 660px; overflow: hidden; border-radius: 10px;\" src=\"https:\/\/embed.podcasts.apple.com\/us\/podcast\/episode-12-solarwinds-hack-the-invisible-cyber-theft\/id1684835330?i=1000713141503\" height=\"175\" frameborder=\"0\" sandbox=\"allow-forms allow-popups allow-same-origin allow-scripts allow-storage-access-by-user-activation allow-top-navigation-by-user-activation\"><\/iframe><\/a>\n<div class=\"fusion-text fusion-text-5\"><h2 id=\"ember405\" class=\"ember-view reader-text-block__heading-2\"><span class=\"ez-toc-section\" id=\"Why_can_this_incident_affect_any_website\"><\/span>Why can this incident affect any website?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p id=\"ember406\" class=\"ember-view reader-text-block__paragraph\">The truly alarming part of the eMudhra incident: <strong>not a single affected website needs to be compromised itself.<\/strong><\/p>\n<p id=\"ember407\" class=\"ember-view reader-text-block__paragraph\">That&rsquo;s because in this case, no TLS keys belonging to individual websites were stolen. The private keys of eight higher-level intermediate certificate authorities can be reconstructed due to flawed key generation.<\/p>\n<p id=\"ember408\" class=\"ember-view reader-text-block__paragraph\">Six of these keys are authorized to sign TLS certificates.<\/p>\n<p id=\"ember409\" class=\"ember-view reader-text-block__paragraph\">This allows an attacker to issue certificates for third-party websites &ndash; regardless of which certificate authority their operators actually use for their genuine certificates.<\/p>\n<p id=\"ember410\" class=\"ember-view reader-text-block__paragraph\">This applies to banking portals just as much as to online shops, Git repositories, and identity providers.<\/p>\n<p id=\"ember411\" class=\"ember-view reader-text-block__paragraph\">If an attacker can also intercept or redirect network traffic, and the affected application trusts the forged certificate chain, they can impersonate a legitimate server.<\/p>\n<p id=\"ember412\" class=\"ember-view reader-text-block__paragraph\"><strong>The real website itself may remain completely untouched. What&rsquo;s under attack is the client&rsquo;s trust decision. <\/strong><\/p>\n<p id=\"ember413\" class=\"ember-view reader-text-block__paragraph\">That&rsquo;s the crucial difference!<\/p>\n<h3 id=\"ember414\" class=\"ember-view reader-text-block__heading-3\"><span class=\"ez-toc-section\" id=\"eMudhra_%E2%80%93_8_Compromised_Certificate_Authority_CA_Keys_%E2%80%93_Attack_Vectors_and_Damage_Scenarios\"><\/span>eMudhra &ndash; 8 Compromised Certificate Authority (CA) Keys &ndash; Attack Vectors and Damage Scenarios<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p id=\"ember415\" class=\"ember-view reader-text-block__paragraph\">To <strong>illustrate the attack vectors and damage scenarios<\/strong>, I&rsquo;ve put together the following graphic for you:<\/p>\n<div id=\"attachment_5748\" style=\"width: 2570px\" class=\"wp-caption aligncenter\"><img decoding=\"async\" aria-describedby=\"caption-attachment-5748\" class=\"wp-image-5748 size-full\" src=\"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/eMudhra-8-kompromittierte-Certificate-Authorities-CAs-Schluessel-scaled.jpg\" alt=\"eMudhra - 8 compromised Certificate Authority (CA) keys - attack vectors and damage scenarios - Illustration by Sascha Block - www.rock-the-prototype.com \" width=\"2560\" height=\"1893\" srcset=\"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/eMudhra-8-kompromittierte-Certificate-Authorities-CAs-Schluessel-200x148.jpg 200w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/eMudhra-8-kompromittierte-Certificate-Authorities-CAs-Schluessel-300x222.jpg 300w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/eMudhra-8-kompromittierte-Certificate-Authorities-CAs-Schluessel-400x296.jpg 400w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/eMudhra-8-kompromittierte-Certificate-Authorities-CAs-Schluessel-600x444.jpg 600w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/eMudhra-8-kompromittierte-Certificate-Authorities-CAs-Schluessel-768x568.jpg 768w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/eMudhra-8-kompromittierte-Certificate-Authorities-CAs-Schluessel-800x592.jpg 800w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/eMudhra-8-kompromittierte-Certificate-Authorities-CAs-Schluessel-1024x757.jpg 1024w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/eMudhra-8-kompromittierte-Certificate-Authorities-CAs-Schluessel-1200x888.jpg 1200w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/eMudhra-8-kompromittierte-Certificate-Authorities-CAs-Schluessel-1536x1136.jpg 1536w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/eMudhra-8-kompromittierte-Certificate-Authorities-CAs-Schluessel-scaled.jpg 2560w\" sizes=\"(max-width: 2560px) 100vw, 2560px\"><p id=\"caption-attachment-5748\" class=\"wp-caption-text\">eMudhra &ndash; 8 compromised Certificate Authority (CA) keys &ndash; attack vectors and damage scenarios &ndash; Illustration by Sascha Block &ndash; www.rock-the-prototype.com<\/p><\/div>\n<p id=\"ember398\" class=\"ember-view reader-text-block__paragraph\">\n<\/p><\/div><div class=\"fusion-text fusion-text-6\"><p>Mozilla and Google responded as early as October 17 with blocking measures. Modern browsers also widely enforce Certificate Transparency and can reject unlogged certificates.<\/p>\n<p>Two other compromised artifacts were software signing keys. However, software uses different mechanisms within its own, often custom-designed, chain of trust.<\/p>\n<p>That is why it was particularly concerning that command-line tools, server applications, development environments, and applications with their own certificate stores continued to trust these compromised keys.<\/p>\n<p>Even an updated operating system offered no protection in this case, provided that its components&mdash;that is, the applications installed with it&mdash;were protected, to the extent that they were affected.<\/p>\n<p>So who verifies which certification authorities our applications actually trust&mdash;and whether they reliably reject compromised certificate chains?<\/p>\n<p><strong>A publicly accessible website has provided the first concrete test certificate chains and verification endpoints:<\/strong><\/p>\n<p id=\"ember423\" class=\"ember-view reader-text-block__paragraph\"><a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/emudhra.we-have-a-problem.com\/\" target=\"_self\" data-test-app-aware-link=\"\">https:\/\/emudhra.we-have-a-problem.com\/<\/a><\/p>\n<p>This website provided me with valuable information and served as the starting point for my own tests on Rust-BFF.<\/p>\n<p><strong>What remains much more relevant to me is the question of how we can provide reproducible evidence for such security decisions in the future.<\/strong><\/p>\n<h2 id=\"ember426\" class=\"ember-view reader-text-block__heading-2\"><span class=\"ez-toc-section\" id=\"What_does_this_mean_for_our_software\"><\/span>What does this mean for our software?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p id=\"ember427\" class=\"ember-view reader-text-block__paragraph\">I took this incident as an opportunity to review the dependencies of my publicly developed <a href=\"https:\/\/github.com\/rock-the-prototype\/rtp-bff\" target=\"_blank\" rel=\"noopener\"><strong>Backend-for-Frontend (BFF)<\/strong> for Rock the Prototype<\/a>.<\/p>\n<p id=\"ember428\" class=\"ember-view reader-text-block__paragraph\">I am developing this B<a href=\"https:\/\/github.com\/rock-the-prototype\/rtp-bff\" target=\"_blank\" rel=\"noopener\">ackend-for-Frontend (BFF) in Rust<\/a>. Rust is particularly well-suited for this because this <a href=\"https:\/\/rock-the-prototype.com\/en\/learn-programming\/programming\/\" target=\"_blank\" title=\"What is programming? When programming, a programmer creates a software program that can run on a machine. The code is created in one of the formally defined computer languages - which are countless, such as Java, PHP, C++ or C#, Perl and many many more.\" class=\"encyclopedia\">programming<\/a> language prevents many memory and concurrency errors at compile time, enables resource-efficient operation, and provides a robust foundation for later deploying the prototype in production.<\/p>\n<p id=\"ember429\" class=\"ember-view reader-text-block__paragraph\">In my&nbsp;<a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/youtu.be\/HNcQi55rqNo\" data-test-app-aware-link=\"\">YouTube Video &#127850; Cookies, Session &amp; Token &#10055;&#65039; Understand Token Flow in 10 Minutes<\/a> you&rsquo;ll learn the technical basics in a way that&rsquo;s easy to understand yet precise:<\/p>\n<ul>\n<li>How is an authenticated identity created, who verifies it, and which components can trust it?<\/li>\n<li>Why a &ldquo;Backend for Frontend&rdquo; can securely manage tokens on the server side.<\/li>\n<li>How DPoP or mTLS can cryptographically bind a token to a legitimate client.<\/li>\n<\/ul>\n<\/div><div class=\"fusion-video fusion-youtube\" style=\"--awb-max-width:1920px;--awb-max-height:1080px;\"><div class=\"video-shortcode\"><priv-fac-lite-youtube class=\"fusion-hidden lty-load\" data-privacy-type=\"youtube\" videoid=\"HNcQi55rqNo\" params=\"wmode=transparent&amp;autoplay=1&amp;enablejsapi=1\" title=\"YouTube video player 1\" data-button-label=\"Play Video\" width=\"1920\" height=\"1080\" data-thumbnail-size=\"auto\" data-no-cookie=\"on\"><\/priv-fac-lite-youtube><div class=\"fusion-privacy-placeholder\" style=\"width:1920px; height:1080px;\" data-privacy-type=\"youtube\"><div class=\"fusion-privacy-placeholder-content\"><div class=\"fusion-privacy-label\">For privacy reasons YouTube needs your permission to be loaded. For more details, please see our <a class=\"privacy-policy-link\" href=\"https:\/\/rock-the-prototype.com\/datenschutzerklaerung\/\" rel=\"privacy-policy\">Datenschutzerkl&auml;rung<\/a>.<\/div><button data-privacy-type=\"youtube\" class=\"fusion-button button-default fusion-button-default-size button fusion-privacy-consent\">I Accept<\/button><\/div><\/div><\/div><\/div><div class=\"fusion-text fusion-text-7\"><p id=\"ember431\" class=\"ember-view reader-text-block__paragraph\">The <strong>Backend-for-Frontend<\/strong> handles the login process via <a href=\"https:\/\/rock-the-prototype.com\/en\/it-security\/openid\/\" target=\"_blank\" title=\"All about OpenID - Discover everything you need to know about OpenID: from secure authentication and identity federation to the latest developments like OpenID Connect and the OpenID Foundation. Here you will find a comprehensive overview of digital identity.\" class=\"encyclopedia\">OpenID<\/a> Connect and verifies the user&rsquo;s identity based on the signed ID token and the associated user data. The BFF manages the authenticated session server-side in <a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/www.linkedin.com\/company\/redisinc\/\" data-test-app-aware-link=\"\">Redis<\/a>. The browser receives a protected session cookie.<\/p>\n<p id=\"ember432\" class=\"ember-view reader-text-block__paragraph\">Access and refresh tokens remain on the server and are never transmitted to the browser. According to <a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/www.google.com\/url?sa=t&amp;source=web&amp;rct=j&amp;opi=89978449&amp;url=https:\/\/www.ietf.org\/ietf-ftp\/rfc\/rfc10017.html&amp;ved=2ahUKEwjE873sq-eXAxXTA9sEHXslG6sQFnoECCYQAQ&amp;usg=AOvVaw1PLa2t7_SF6ayAdgHfIq90\" target=\"_self\" data-test-app-aware-link=\"\">RFC 10017 (BCP 212), &ldquo;OAuth 2.0 for Browser-Based Applications&rdquo;,<\/a> the Backend-for-Frontend pattern is considered the most secure of the OAuth architectures compared there for browser-based applications. The <a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/www.linkedin.com\/company\/internet-engineering-task-force\/\" data-test-app-aware-link=\"\">Internet Engineering Task Force<\/a> (IETF) explicitly recommends the BFF pattern for security-sensitive web applications.<\/p>\n<p id=\"ember433\" class=\"ember-view reader-text-block__paragraph\">Here, <a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/github.com\/rock-the-prototype\/rtp-bff\" target=\"_self\" data-test-app-aware-link=\"\"><strong>my Rust BFF<\/strong><\/a> uses, among others, two relevant components:<\/p>\n<ul>\n<li>webpki-roots, which provides trusted root certificates.<\/li>\n<li>rustls-webpki, which validates certificate chains.<\/li>\n<\/ul>\n<p id=\"ember435\" class=\"ember-view reader-text-block__paragraph\">Naturally, in their respective current versions, since the new version of rustls-webpki explicitly rejects certificate chains containing certain compromised public intermediate keys.<\/p>\n<p id=\"ember436\" class=\"ember-view reader-text-block__paragraph\">At the same time, we need to verify the identity binding within an application like my BFF ourselves. We improve the use of updated OIDC signing keys by adding a negative test: if the identities from the ID token and UserInfo don&rsquo;t match, the BFF rejects the <a href=\"https:\/\/rock-the-prototype.com\/en\/it-security\/authentication\/\" target=\"_blank\" title=\"Authentication is a multi-step process in identity management. Authentication in an IT system implements IT security functions that are realized by various security services and components.\" class=\"encyclopedia\">authentication<\/a>.<\/p>\n<p id=\"ember437\" class=\"ember-view reader-text-block__paragraph\">These changes are integrated into my public <a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/www.linkedin.com\/company\/github\/\" data-test-app-aware-link=\"\">GitHub<\/a> repository and can be traced through pull requests and automated tests.<\/p>\n<p id=\"ember438\" class=\"ember-view reader-text-block__paragraph\">However, two further RustSec findings still require a documented risk assessment. The standalone proof that our specific TLS verification path rejects the compromised certificate chains is also still outstanding.<\/p>\n<div id=\"attachment_5749\" style=\"width: 1498px\" class=\"wp-caption aligncenter\"><img decoding=\"async\" aria-describedby=\"caption-attachment-5749\" class=\"size-full wp-image-5749\" src=\"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Trust-Certificates-and-Revocation-Sascha-Block.png\" alt=\"Secure by Design - how should secure processes look like today?\" width=\"1488\" height=\"834\" srcset=\"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Trust-Certificates-and-Revocation-Sascha-Block-200x112.png 200w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Trust-Certificates-and-Revocation-Sascha-Block-300x168.png 300w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Trust-Certificates-and-Revocation-Sascha-Block-400x224.png 400w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Trust-Certificates-and-Revocation-Sascha-Block-600x336.png 600w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Trust-Certificates-and-Revocation-Sascha-Block-768x430.png 768w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Trust-Certificates-and-Revocation-Sascha-Block-800x448.png 800w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Trust-Certificates-and-Revocation-Sascha-Block-1024x574.png 1024w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Trust-Certificates-and-Revocation-Sascha-Block-1200x673.png 1200w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Trust-Certificates-and-Revocation-Sascha-Block.png 1488w\" sizes=\"(max-width: 1488px) 100vw, 1488px\"><p id=\"caption-attachment-5749\" class=\"wp-caption-text\">Secure by Design &ndash; how should secure processes look like today?<\/p><\/div>\n<div class=\"reader-image-block reader-image-block--full-width\">\n<figure class=\"reader-image-block__figure\">\n<div class=\"ivm-image-view-model reader-image-block__img-container\">\n<div class=\"ivm-view-attr__img-wrapper \"><\/div>\n<\/div>\n<\/figure>\n<\/div>\n<\/div><div class=\"fusion-text fusion-text-8\"><h2 id=\"ember440\" class=\"ember-view reader-text-block__heading-2\"><span class=\"ez-toc-section\" id=\"How_can_trust_be_demonstrably_verified\"><\/span>How can trust be demonstrably verified?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p id=\"ember441\" class=\"ember-view reader-text-block__paragraph\">For me, this results in a clear technical and organizational requirement.<\/p>\n<p id=\"ember442\" class=\"ember-view reader-text-block__paragraph\">We need a traceable connection between the components of our software, the cryptographic methods actually in use, the applicable trust rules, and the results of concrete verification.<\/p>\n<p id=\"ember443\" class=\"ember-view reader-text-block__paragraph\">The <a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/www.linkedin.com\/company\/owasp-cyclonedx\/\" data-test-app-aware-link=\"\">OWASP CycloneDX SBOM\/xBOM standard<\/a> offers a solid foundation for this.<\/p>\n<p id=\"ember444\" class=\"ember-view reader-text-block__paragraph\">A <strong>Software Bill of Materials (SBOM)<\/strong> makes the software components and dependencies in use visible.<\/p>\n<p id=\"ember445\" class=\"ember-view reader-text-block__paragraph\">A <strong>Cryptography Bill of Materials (CBOM)<\/strong> can link cryptographic assets such as algorithms, keys, and certificates to these components.<\/p>\n<p id=\"ember446\" class=\"ember-view reader-text-block__paragraph\"><strong>What&rsquo;s still missing is the actual proof of effectiveness. <\/strong><\/p>\n<p id=\"ember447\" class=\"ember-view reader-text-block__paragraph\">Does the application accept a valid certificate chain &ndash; and does it demonstrably reject a compromised certificate chain?<\/p>\n<p id=\"ember448\" class=\"ember-view reader-text-block__paragraph\"><strong>Such a test must be reproducible.<\/strong> It must relate to a specific software state and a concrete trust configuration. <strong>And its result must remain traceable.<\/strong><\/p>\n<p id=\"ember449\" class=\"ember-view reader-text-block__paragraph\">With the <a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/www.google.com\/url?sa=t&amp;source=web&amp;rct=j&amp;opi=89978449&amp;url=https:\/\/github.com\/Agile-Innovation\/Agile-Innovation-Framework&amp;ved=2ahUKEwizxMifreeXAxVwVfEDHZc7EFwQFnoECB8QAQ&amp;usg=AOvVaw0ibU7ymuUWstrQGtjsZDyt\" target=\"_self\" data-test-app-aware-link=\"\">Agile Innovation Framework (AIF)<\/a>, I want to map out exactly these connections: from the requirement, through the verification method and observation, to the validated result and the corresponding evidence.<\/p>\n<p id=\"ember450\" class=\"ember-view reader-text-block__paragraph\">This isn&rsquo;t a finished audit system yet. But it&rsquo;s a verifiable path toward developing one transparently, step by step.<\/p>\n<h2 id=\"ember451\" class=\"ember-view reader-text-block__heading-2\"><span class=\"ez-toc-section\" id=\"Why_this_goes_far_beyond_TLS\"><\/span>Why this goes far beyond TLS<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p id=\"ember452\" class=\"ember-view reader-text-block__paragraph\">We encounter the same fundamental question with digital identities.<\/p>\n<p id=\"ember453\" class=\"ember-view reader-text-block__paragraph\">With the European EUDI Wallet or our own <strong>d-you<\/strong>, as the <strong>digital wallet for Germany<\/strong> is called, new trust relationships are emerging between wallets, issuers of digital credentials, and verifying organizations.<\/p>\n<p id=\"ember454\" class=\"ember-view reader-text-block__paragraph\">The trust lists, certificates, and status mechanisms used there differ from the Web PKI. However, the underlying technical challenge remains comparable:<\/p>\n<p id=\"ember455\" class=\"ember-view reader-text-block__paragraph\">A valid cryptographic signature alone isn&rsquo;t enough. What also matters is whether the issuer is trustworthy for the given purpose and whether the presented credential is valid at the time of verification.<\/p>\n<p id=\"ember456\" class=\"ember-view reader-text-block__paragraph\">This makes <strong>verifying digital trust decisions<\/strong> a task that spans the entire <strong>software lifecycle<\/strong>.<\/p>\n<p id=\"ember457\" class=\"ember-view reader-text-block__paragraph\">Security requires far more than ongoing updates.<\/p>\n<\/div><div class=\"fusion-text fusion-text-9\"><p id=\"ember458\" class=\"ember-view reader-text-block__paragraph\">Back during the PHP2Shell security incident, we already examined the importance of shared open-source infrastructure and its long-term maintenance.<\/p>\n<p id=\"ember459\" class=\"ember-view reader-text-block__paragraph\">The eMudhra incident reveals another dimension.<\/p>\n<p id=\"ember460\" class=\"ember-view reader-text-block__paragraph\">Even when maintainers respond quickly and <a href=\"https:\/\/rock-the-prototype.com\/en\/learn-programming\/release\/\" target=\"_blank\" title=\"A release is a defined software version of an application. A software release is therefore a software version defined for users with a defined range of functions and maturity level. An initial software release generally represents the first generation of a new or improved software application.\" class=\"encyclopedia\">release<\/a> security updates, organizations still need to identify which of their systems are affected, integrate the changes in a traceable way, and verify their effectiveness.<\/p>\n<p id=\"ember461\" class=\"ember-view reader-text-block__paragraph\">This requires technical capability. But above all, it requires accountability, transparent decisions, and verifiable results.<\/p>\n<p id=\"ember462\" class=\"ember-view reader-text-block__paragraph\">My goal, therefore, isn&rsquo;t just to develop trustworthy software. I want to make it transparent why we&rsquo;re justified in trusting it &ndash; and how we translate new insights into effective changes.<\/p>\n<p id=\"ember463\" class=\"ember-view reader-text-block__paragraph\">IT security and effective collaboration require transparency.<\/p>\n<p id=\"ember464\" class=\"ember-view reader-text-block__paragraph\">That&rsquo;s exactly why Rock the Prototype exists.<\/p>\n<p id=\"ember465\" class=\"ember-view reader-text-block__paragraph\">Yours, Sascha Block<\/p>\n<h3 id=\"ember468\" class=\"ember-view reader-text-block__heading-3\"><span class=\"ez-toc-section\" id=\"Sources_and_technical_references\"><\/span>Sources and technical references<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p id=\"ember469\" class=\"ember-view reader-text-block__paragraph\">JetBrains &ndash; eMudhra Certificate Authority Incident:<\/p>\n<p id=\"ember470\" class=\"ember-view reader-text-block__paragraph\"><a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/blog.jetbrains.com\/security\/2026\/10\/emudhra-certificate-authority-incident-status-and-guidance-for-jetbrains-products\/\" target=\"_self\" data-test-app-aware-link=\"\">https:\/\/blog.jetbrains.com\/security\/2026\/10\/emudhra-certificate-authority-incident-status-and-guidance-for-jetbrains-products\/<\/a><\/p>\n<p id=\"ember471\" class=\"ember-view reader-text-block__paragraph\">Mozilla &ndash; response to the compromised intermediate certificates:<\/p>\n<p id=\"ember472\" class=\"ember-view reader-text-block__paragraph\"><a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/blog.mozilla.org\/security\/2026\/10\/20\/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates\/\" target=\"_self\" data-test-app-aware-link=\"\">https:\/\/blog.mozilla.org\/security\/2026\/10\/20\/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates\/<\/a><\/p>\n<p id=\"ember473\" class=\"ember-view reader-text-block__paragraph\">Google &ndash; Chrome and Android:<\/p>\n<p id=\"ember474\" class=\"ember-view reader-text-block__paragraph\"><a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/blog.google\/security\/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates\/\" target=\"_self\" data-test-app-aware-link=\"\">https:\/\/blog.google\/security\/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates\/<\/a><\/p>\n<p id=\"ember475\" class=\"ember-view reader-text-block__paragraph\">RustSec &ndash; webpki-roots:<\/p>\n<p id=\"ember476\" class=\"ember-view reader-text-block__paragraph\"><a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/rustsec.org\/advisories\/RUSTSEC-2026-0381\" target=\"_self\" data-test-app-aware-link=\"\">https:\/\/rustsec.org\/advisories\/RUSTSEC-2026-0381<\/a><\/p>\n<p id=\"ember477\" class=\"ember-view reader-text-block__paragraph\">RustSec &ndash; rustls-webpki:<\/p>\n<p id=\"ember478\" class=\"ember-view reader-text-block__paragraph\"><a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/rustsec.org\/advisories\/RUSTSEC-2026-0382\" target=\"_self\" data-test-app-aware-link=\"\">https:\/\/rustsec.org\/advisories\/RUSTSEC-2026-0382<\/a><\/p>\n<p id=\"ember479\" class=\"ember-view reader-text-block__paragraph\">CycloneDX &ndash; Cryptography Bill of Materials:<\/p>\n<p id=\"ember480\" class=\"ember-view reader-text-block__paragraph\"><a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/cyclonedx.org\/capabilities\/cbom\/\" target=\"_self\" data-test-app-aware-link=\"\">https:\/\/cyclonedx.org\/capabilities\/cbom\/<\/a><\/p>\n<p id=\"ember481\" class=\"ember-view reader-text-block__paragraph\">EUDI Wallet &ndash; trust verification:<\/p>\n<p id=\"ember482\" class=\"ember-view reader-text-block__paragraph\"><a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/eudi-wallet.gov.de\/faq\" target=\"_self\" data-test-app-aware-link=\"\">https:\/\/eudi-wallet.gov.de\/faq<\/a><\/p>\n<p id=\"ember483\" class=\"ember-view reader-text-block__paragraph\">My public BFF prototype:<\/p>\n<p id=\"ember484\" class=\"ember-view reader-text-block__paragraph\"><a class=\"mZqHjFxVEGMzKmwfFQNmwkzEvZsYTLQ \" tabindex=\"0\" href=\"https:\/\/github.com\/rock-the-prototype\/rtp-bff\" target=\"_self\" data-test-app-aware-link=\"\">https:\/\/github.com\/rock-the-prototype\/rtp-bff<\/a><\/p>\n<\/div><\/div><\/div><\/div><\/div><div class=\"fusion-fullwidth fullwidth-box fusion-builder-row-2 fusion-flex-container has-pattern-background has-mask-background nonhundred-percent-fullwidth non-hundred-percent-height-scrolling\" style=\"--awb-border-radius-top-left:0px;--awb-border-radius-top-right:0px;--awb-border-radius-bottom-right:0px;--awb-border-radius-bottom-left:0px;--awb-flex-wrap:wrap;\"><div class=\"fusion-builder-row fusion-row fusion-flex-align-items-flex-start fusion-flex-content-wrap\" style=\"max-width:1144px;margin-left: calc(-4% \/ 2 );margin-right: calc(-4% \/ 2 );\"><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-1 fusion_builder_column_1_1 1_1 fusion-flex-column\" style=\"--awb-bg-size:cover;--awb-width-large:100%;--awb-margin-top-large:0px;--awb-spacing-right-large:1.92%;--awb-margin-bottom-large:0px;--awb-spacing-left-large:1.92%;--awb-width-medium:100%;--awb-order-medium:0;--awb-spacing-right-medium:1.92%;--awb-spacing-left-medium:1.92%;--awb-width-small:100%;--awb-order-small:0;--awb-spacing-right-small:1.92%;--awb-spacing-left-small:1.92%;\"><div class=\"fusion-column-wrapper fusion-column-has-shadow fusion-flex-justify-content-flex-start fusion-content-layout-column\"><a class=\"fusion-modal-text-link\" data-toggle=\"modal\" data-target=\".fusion-modal.Rock the Prototype - Software development &amp; Prototyping Podcast iTunes\" href=\"#\"><iframe id=\"embedPlayer\" style=\"width: 100%; max-width: 660px; overflow: hidden; border-radius: 10px; transform: translateZ(0px); animation: 2s ease 0s 6 normal none running loading-indicator; background-color: #e4e4e4;\" src=\"https:\/\/embed.podcasts.apple.com\/us\/podcast\/rock-the-prototype-software-development-prototyping\/id1684835330?itsct=podcast_box_player&amp;itscg=30200&amp;ls=1&amp;theme=auto\" height=\"450px\" frameborder=\"0\" sandbox=\"allow-forms allow-popups allow-same-origin allow-scripts allow-top-navigation-by-user-activation\"><\/iframe><\/a><\/div><\/div><\/div><\/div>\n<div class=\"fusion-fullwidth fullwidth-box fusion-builder-row-3 fusion-flex-container has-pattern-background has-mask-background nonhundred-percent-fullwidth non-hundred-percent-height-scrolling\" style=\"--awb-border-radius-top-left:0px;--awb-border-radius-top-right:0px;--awb-border-radius-bottom-right:0px;--awb-border-radius-bottom-left:0px;--awb-flex-wrap:wrap;\"><div class=\"fusion-builder-row fusion-row fusion-flex-align-items-flex-start fusion-flex-content-wrap\" style=\"max-width:1144px;margin-left: calc(-4% \/ 2 );margin-right: calc(-4% \/ 2 );\"><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-2 fusion_builder_column_1_3 1_3 fusion-flex-column\" style=\"--awb-bg-size:cover;--awb-width-large:33.333333333333%;--awb-margin-top-large:0px;--awb-spacing-right-large:5.76%;--awb-margin-bottom-large:0px;--awb-spacing-left-large:5.76%;--awb-width-medium:100%;--awb-order-medium:0;--awb-spacing-right-medium:1.92%;--awb-spacing-left-medium:1.92%;--awb-width-small:100%;--awb-order-small:0;--awb-spacing-right-small:1.92%;--awb-spacing-left-small:1.92%;\"><div class=\"fusion-column-wrapper fusion-column-has-shadow fusion-flex-justify-content-flex-start fusion-content-layout-column\"><div class=\"fusion-title title fusion-title-1 fusion-sep-none fusion-title-text fusion-title-size-two\" style=\"--awb-margin-top-small:30px;--awb-margin-right-small:0px;--awb-margin-bottom-small:20px;--awb-margin-left-small:0px;\"><h2 class=\"fusion-title-heading title-heading-left fusion-responsive-typography-calculated\" style=\"margin:0;--fontSize:30;line-height:1.1;\"><span class=\"ez-toc-section\" id=\"About_the_Author\"><\/span>About the Author:<span class=\"ez-toc-section-end\"><\/span><\/h2><\/div><div class=\"fusion-image-element\" style=\"--awb-caption-title-font-family:var(--h2_typography-font-family);--awb-caption-title-font-weight:var(--h2_typography-font-weight);--awb-caption-title-font-style:var(--h2_typography-font-style);--awb-caption-title-size:var(--h2_typography-font-size);--awb-caption-title-transform:var(--h2_typography-text-transform);--awb-caption-title-line-height:var(--h2_typography-line-height);--awb-caption-title-letter-spacing:var(--h2_typography-letter-spacing);\"><span class=\" fusion-imageframe imageframe-none imageframe-1 hover-type-none\"><img decoding=\"async\" width=\"1920\" height=\"1920\" title=\"Sascha Block &ndash; Rock the Prototype\" src=\"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2019\/09\/Sascha_Block.jpg\" alt class=\"img-responsive wp-image-3342\" srcset=\"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2019\/09\/Sascha_Block-200x200.jpg 200w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2019\/09\/Sascha_Block-400x400.jpg 400w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2019\/09\/Sascha_Block-600x600.jpg 600w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2019\/09\/Sascha_Block-800x800.jpg 800w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2019\/09\/Sascha_Block-1200x1200.jpg 1200w, https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2019\/09\/Sascha_Block.jpg 1920w\" sizes=\"(max-width: 1024px) 100vw, (max-width: 640px) 100vw, 400px\"><\/span><\/div><\/div><\/div><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-3 fusion_builder_column_2_3 2_3 fusion-flex-column\" style=\"--awb-bg-size:cover;--awb-width-large:66.666666666667%;--awb-margin-top-large:0px;--awb-spacing-right-large:2.88%;--awb-margin-bottom-large:0px;--awb-spacing-left-large:2.88%;--awb-width-medium:100%;--awb-order-medium:0;--awb-spacing-right-medium:1.92%;--awb-spacing-left-medium:1.92%;--awb-width-small:100%;--awb-order-small:0;--awb-spacing-right-small:1.92%;--awb-spacing-left-small:1.92%;\"><div class=\"fusion-column-wrapper fusion-column-has-shadow fusion-flex-justify-content-flex-start fusion-content-layout-column\"><div class=\"fusion-title title fusion-title-2 fusion-sep-none fusion-title-text fusion-title-size-three\" style=\"--awb-margin-top-small:30px;--awb-margin-right-small:0px;--awb-margin-bottom-small:20px;--awb-margin-left-small:0px;\"><h3 class=\"fusion-title-heading title-heading-left fusion-responsive-typography-calculated\" style=\"margin:0;--fontSize:26;line-height:1.2;\"><span class=\"ez-toc-section\" id=\"Sascha_Block\"><\/span>Sascha Block<span class=\"ez-toc-section-end\"><\/span><\/h3><\/div><div class=\"fusion-text fusion-text-10\"><p>I am <a href=\"https:\/\/www.linkedin.com\/in\/sascha-block-5785b9126\/\">Sascha Block<\/a> &ndash; IT architect in Hamburg and the initiator of Rock the Prototype. I want to make <a href=\"https:\/\/rock-the-prototype.com\/en\/prototyping-en\/prototyping\/\" target=\"_blank\" title=\"What is prototyping? Prototyping is both a process and a strategy for realizing ideas as quickly as possible.\" class=\"encyclopedia\">prototyping<\/a> learnable and experiential. With the motivation to prototype ideas and share knowledge around software prototyping, software architecture and programming, I created the format and the open source initiative Rock the Prototype.<\/p>\n<\/div><div><a class=\"fusion-button button-flat fusion-button-default-size button-default fusion-button-default button-1 fusion-button-default-span fusion-button-default-type\" target=\"_blank\" rel=\"noopener noreferrer\" href=\"https:\/\/rock-the-prototype.com\/programmieren-lernen\/strategien-zur-code-optimierung-und-algorithmen-effizienz-beispiele-best-practices\/\"><span class=\"fusion-button-text awb-button__text awb-button__text--default\">Strategies for code optimization and algorithm efficiency: examples &amp; best practices<\/span><\/a><\/div><div class=\"fusion-separator fusion-full-width-sep\" style=\"align-self: center;margin-left: auto;margin-right: auto;width:100%;\"><\/div><ul style=\"--awb-line-height:23.8px;--awb-icon-width:23.8px;--awb-icon-height:23.8px;--awb-icon-margin:9.8px;--awb-content-margin:33.6px;--awb-circlecolor:var(--awb-color3);--awb-circle-yes-font-size:12.32px;\" class=\"fusion-checklist fusion-checklist-1 fusion-checklist-default type-icons\"><li class=\"fusion-li-item\" style=\"\"><span class=\"icon-wrapper circle-yes\"><i class=\"fusion-li-icon fa-link fas\" aria-hidden=\"true\"><\/i><\/span><div class=\"fusion-li-item-content\">\n<p><a href=\"https:\/\/rock-the-prototype.com\/en\/\">rock-the-prototype.com<\/a><\/p>\n<\/div><\/li><\/ul><\/div><\/div><\/div><\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>Compromised CA Keys, Revoked Certificates &#8211; How Do We Verify That Revocation Really Works &#8211; eMudhra Security Incident: Eight compromised CA keys raise a fairly fundamental question for many of us in October 2026: &#8220;What&#8217;s the point of revoking a certificate if applications keep trusting it anyway?&#8221;<\/p>\n","protected":false},"author":1,"featured_media":5767,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1232],"tags":[5068,5069,5070,5071,5072,5118,5117,5073,5074,5075,5119,5076,5077,5090,5091,5078,5092,5093,5079,5080,2203,5081,2502,5083,5013,5082,5084,5085,3632,5086,3224,5087,5088,1235,5089,5105,2602,2409,5094,5095,5096,5097,2499,2498,5098,5099,5100,5101,3443,5102,5103,5104,5106,5107,4699,5109,5017,5110,2530,3610,5111,5113,5112,5114,5115,5116,1239],"class_list":["post-5756","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it-security","tag-auditability","tag-browser-security","tag-ca-bundle","tag-certificate-authorities","tag-certificate-authority","tag-certificate-chains","tag-certificate-forgery","tag-certificate-revocation","tag-certificate-revocation-list","tag-certificate-transparency","tag-certificate-validation","tag-code-signing","tag-code-signing-certificates","tag-compromised-ca-keys","tag-compromised-private-keys","tag-crl","tag-cryptographic-keys","tag-cryptographic-vulnerabilities","tag-ct-logs","tag-curl","tag-cybersecurity-en","tag-cyclonedx","tag-digital-certificates","tag-digital-signatures","tag-digital-sovereignty","tag-digital-trust","tag-emudhra","tag-emudhra-security-incident","tag-git-en","tag-git-native-evidence","tag-https-en","tag-identity-spoofing","tag-intermediate-ca","tag-it-security-en","tag-jetbrains","tag-key-generation","tag-macos-en","tag-malware-en","tag-man-in-the-middle","tag-mitm","tag-ocsp","tag-open-source-security","tag-pki-en","tag-public-key-infrastructure-en","tag-reproducible-security-testing","tag-revocation","tag-root-ca","tag-root-store","tag-rust-en","tag-rustls","tag-rustls-webpki","tag-sbom","tag-secure-by-design","tag-security-evidence","tag-security-by-design-en","tag-software-signatures","tag-software-supply-chain","tag-supply-chain-security","tag-tls-en","tag-tls-certificates","tag-tls-trust-validation","tag-trust-anchor","tag-trust-store","tag-webpki-roots","tag-website-impersonation","tag-x-509","tag-zero-trust-en"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Compromised CA Keys, Revoked Certificates - How Do We Verify That Revocation Really Works - Rock the Prototype - Softwareentwicklung &amp; Prototyping<\/title>\n<meta name=\"description\" content=\"eMudhra: Eight compromised CA keys jeopardize HTTPS and software signatures. Why certificate revocation isn&#039;t enough \u2013 and how do we verify it?\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Compromised CA Keys, Revoked Certificates - How Do We Verify That Revocation Really Works - Rock the Prototype - Softwareentwicklung &amp; Prototyping\" \/>\n<meta property=\"og:description\" content=\"eMudhra: Eight compromised CA keys jeopardize HTTPS and software signatures. Why certificate revocation isn&#039;t enough \u2013 and how do we verify it?\" \/>\n<meta property=\"og:url\" content=\"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/\" \/>\n<meta property=\"og:site_name\" content=\"Rock the Prototype - Softwareentwicklung &amp; Prototyping\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-02T16:02:23+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-02T16:49:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Compromised-CA-Keys-Revoked-Certificates\u2014How-Do-We-Verify-That-Revocation-Is-Actually-Effective.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1168\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Sascha Block\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@rocktheprototyp\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sascha Block\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\\\/\"},\"author\":{\"name\":\"Sascha Block\",\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/#\\\/schema\\\/person\\\/fdb2f98edec62327712c2d26d981c081\"},\"headline\":\"Compromised CA Keys, Revoked Certificates &#8211; How Do We Verify That Revocation Really Works\",\"datePublished\":\"2026-11-02T16:02:23+00:00\",\"dateModified\":\"2026-11-02T16:49:45+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\\\/\"},\"wordCount\":3223,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/rock-the-prototype.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/Compromised-CA-Keys-Revoked-Certificates\u2014How-Do-We-Verify-That-Revocation-Is-Actually-Effective.jpg\",\"keywords\":[\"Auditability\",\"Browser Security\",\"CA Bundle\",\"Certificate Authorities\",\"Certificate Authority\",\"Certificate Chains\",\"Certificate Forgery\",\"Certificate Revocation\",\"Certificate Revocation List\",\"Certificate Transparency\",\"Certificate Validation\",\"Code Signing\",\"Code Signing Certificates\",\"Compromised CA Keys\",\"Compromised Private Keys\",\"CRL\",\"Cryptographic Keys\",\"Cryptographic Vulnerabilities\",\"CT Logs\",\"curl\",\"Cybersecurity\",\"CycloneDX\",\"digital certificates\",\"Digital Signatures\",\"Digital sovereignty\",\"Digital Trust\",\"eMudhra\",\"eMudhra Security Incident\",\"Git\",\"Git-native Evidence\",\"HTTPS\",\"Identity Spoofing\",\"Intermediate CA\",\"IT Security\",\"JetBrains\",\"Key Generation\",\"MacOS\",\"Malware\",\"Man-in-the-Middle\",\"MITM\",\"OCSP\",\"Open Source Security\",\"PKI\",\"Public Key Infrastructure\",\"Reproducible Security Testing\",\"Revocation\",\"Root CA\",\"Root Store\",\"Rust\",\"rustls\",\"rustls-webpki\",\"SBOM\",\"Secure by Design\",\"Security Evidence\",\"Security-by-Design\",\"Software Signatures\",\"Software Supply Chain\",\"Supply Chain Security\",\"TLS\",\"TLS certificates\",\"TLS Trust Validation\",\"Trust Anchor\",\"Trust Store\",\"webpki-roots\",\"Website Impersonation\",\"X.509\",\"Zero Trust\"],\"articleSection\":[\"IT Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\\\/\",\"url\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\\\/\",\"name\":\"Compromised CA Keys, Revoked Certificates - How Do We Verify That Revocation Really Works - Rock the Prototype - Softwareentwicklung &amp; Prototyping\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/rock-the-prototype.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/Compromised-CA-Keys-Revoked-Certificates\u2014How-Do-We-Verify-That-Revocation-Is-Actually-Effective.jpg\",\"datePublished\":\"2026-11-02T16:02:23+00:00\",\"dateModified\":\"2026-11-02T16:49:45+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/#\\\/schema\\\/person\\\/fdb2f98edec62327712c2d26d981c081\"},\"description\":\"eMudhra: Eight compromised CA keys jeopardize HTTPS and software signatures. Why certificate revocation isn't enough \u2013 and how do we verify it?\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\\\/#primaryimage\",\"url\":\"https:\\\/\\\/rock-the-prototype.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/Compromised-CA-Keys-Revoked-Certificates\u2014How-Do-We-Verify-That-Revocation-Is-Actually-Effective.jpg\",\"contentUrl\":\"https:\\\/\\\/rock-the-prototype.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/Compromised-CA-Keys-Revoked-Certificates\u2014How-Do-We-Verify-That-Revocation-Is-Actually-Effective.jpg\",\"width\":1920,\"height\":1168,\"caption\":\"Compromised CA Keys, Revoked Certificates\u2014How Do We Verify That Revocation Is Actually Effective?\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/it-security\\\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Startseite\",\"item\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/rock-the-prototype\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Compromised CA Keys, Revoked Certificates &#8211; How Do We Verify That Revocation Really Works\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/\",\"name\":\"Rock the Prototype - Softwareentwicklung &amp; Prototyping\",\"description\":\"Prototyping: Software Prototypen, Software entwickeln &amp; Programmieren im Team\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/#\\\/schema\\\/person\\\/fdb2f98edec62327712c2d26d981c081\",\"name\":\"Sascha Block\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/967c419542686b085600443beafb2e55ad1ef6532a0ad9b96d244cb24fd8c117?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/967c419542686b085600443beafb2e55ad1ef6532a0ad9b96d244cb24fd8c117?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/967c419542686b085600443beafb2e55ad1ef6532a0ad9b96d244cb24fd8c117?s=96&d=mm&r=g\",\"caption\":\"Sascha Block\"},\"description\":\"Ich bin Sascha Block \u2013 IT-Architekt in Hamburg und der Initiator von Rock the Prototype. Ich m\u00f6chte Prototyping erlernbar und erfahrbar machen. Mit der Motivation Ideen prototypisch zu verwirklichen und Wissen rund um Software-Prototyping, Softwarearchitektur und Softwareentwicklung zu teilen, habe ich das Format und die Open-Source Initiative Rock the Prototype geschaffen.\",\"sameAs\":[\"https:\\\/\\\/rock-the-prototype.com\",\"https:\\\/\\\/www.instagram.com\\\/rock_the_prototype\\\/\",\"https:\\\/\\\/x.com\\\/rocktheprototyp\",\"https:\\\/\\\/www.youtube.com\\\/@Rock-the-Prototype\\\/\"],\"url\":\"https:\\\/\\\/rock-the-prototype.com\\\/en\\\/author\\\/administrator-2\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Compromised CA Keys, Revoked Certificates - How Do We Verify That Revocation Really Works - Rock the Prototype - Softwareentwicklung &amp; Prototyping","description":"eMudhra: Eight compromised CA keys jeopardize HTTPS and software signatures. Why certificate revocation isn't enough \u2013 and how do we verify it?","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/","og_locale":"en_US","og_type":"article","og_title":"Compromised CA Keys, Revoked Certificates - How Do We Verify That Revocation Really Works - Rock the Prototype - Softwareentwicklung &amp; Prototyping","og_description":"eMudhra: Eight compromised CA keys jeopardize HTTPS and software signatures. Why certificate revocation isn't enough \u2013 and how do we verify it?","og_url":"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/","og_site_name":"Rock the Prototype - Softwareentwicklung &amp; Prototyping","article_published_time":"2026-11-02T16:02:23+00:00","article_modified_time":"2026-11-02T16:49:45+00:00","og_image":[{"width":1920,"height":1168,"url":"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Compromised-CA-Keys-Revoked-Certificates\u2014How-Do-We-Verify-That-Revocation-Is-Actually-Effective.jpg","type":"image\/jpeg"}],"author":"Sascha Block","twitter_card":"summary_large_image","twitter_creator":"@rocktheprototyp","twitter_misc":{"Written by":"Sascha Block","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/#article","isPartOf":{"@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/"},"author":{"name":"Sascha Block","@id":"https:\/\/rock-the-prototype.com\/en\/#\/schema\/person\/fdb2f98edec62327712c2d26d981c081"},"headline":"Compromised CA Keys, Revoked Certificates &#8211; How Do We Verify That Revocation Really Works","datePublished":"2026-11-02T16:02:23+00:00","dateModified":"2026-11-02T16:49:45+00:00","mainEntityOfPage":{"@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/"},"wordCount":3223,"commentCount":0,"image":{"@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/#primaryimage"},"thumbnailUrl":"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Compromised-CA-Keys-Revoked-Certificates\u2014How-Do-We-Verify-That-Revocation-Is-Actually-Effective.jpg","keywords":["Auditability","Browser Security","CA Bundle","Certificate Authorities","Certificate Authority","Certificate Chains","Certificate Forgery","Certificate Revocation","Certificate Revocation List","Certificate Transparency","Certificate Validation","Code Signing","Code Signing Certificates","Compromised CA Keys","Compromised Private Keys","CRL","Cryptographic Keys","Cryptographic Vulnerabilities","CT Logs","curl","Cybersecurity","CycloneDX","digital certificates","Digital Signatures","Digital sovereignty","Digital Trust","eMudhra","eMudhra Security Incident","Git","Git-native Evidence","HTTPS","Identity Spoofing","Intermediate CA","IT Security","JetBrains","Key Generation","MacOS","Malware","Man-in-the-Middle","MITM","OCSP","Open Source Security","PKI","Public Key Infrastructure","Reproducible Security Testing","Revocation","Root CA","Root Store","Rust","rustls","rustls-webpki","SBOM","Secure by Design","Security Evidence","Security-by-Design","Software Signatures","Software Supply Chain","Supply Chain Security","TLS","TLS certificates","TLS Trust Validation","Trust Anchor","Trust Store","webpki-roots","Website Impersonation","X.509","Zero Trust"],"articleSection":["IT Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/","url":"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/","name":"Compromised CA Keys, Revoked Certificates - How Do We Verify That Revocation Really Works - Rock the Prototype - Softwareentwicklung &amp; Prototyping","isPartOf":{"@id":"https:\/\/rock-the-prototype.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/#primaryimage"},"image":{"@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/#primaryimage"},"thumbnailUrl":"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Compromised-CA-Keys-Revoked-Certificates\u2014How-Do-We-Verify-That-Revocation-Is-Actually-Effective.jpg","datePublished":"2026-11-02T16:02:23+00:00","dateModified":"2026-11-02T16:49:45+00:00","author":{"@id":"https:\/\/rock-the-prototype.com\/en\/#\/schema\/person\/fdb2f98edec62327712c2d26d981c081"},"description":"eMudhra: Eight compromised CA keys jeopardize HTTPS and software signatures. Why certificate revocation isn't enough \u2013 and how do we verify it?","breadcrumb":{"@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/#primaryimage","url":"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Compromised-CA-Keys-Revoked-Certificates\u2014How-Do-We-Verify-That-Revocation-Is-Actually-Effective.jpg","contentUrl":"https:\/\/rock-the-prototype.com\/wp-content\/uploads\/2026\/11\/Compromised-CA-Keys-Revoked-Certificates\u2014How-Do-We-Verify-That-Revocation-Is-Actually-Effective.jpg","width":1920,"height":1168,"caption":"Compromised CA Keys, Revoked Certificates\u2014How Do We Verify That Revocation Is Actually Effective?"},{"@type":"BreadcrumbList","@id":"https:\/\/rock-the-prototype.com\/en\/it-security\/compromised-ca-keys-revoked-certificates-how-do-we-verify-that-revocation-really-works\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Startseite","item":"https:\/\/rock-the-prototype.com\/en\/rock-the-prototype\/"},{"@type":"ListItem","position":2,"name":"Compromised CA Keys, Revoked Certificates &#8211; How Do We Verify That Revocation Really Works"}]},{"@type":"WebSite","@id":"https:\/\/rock-the-prototype.com\/en\/#website","url":"https:\/\/rock-the-prototype.com\/en\/","name":"Rock the Prototype - Softwareentwicklung &amp; Prototyping","description":"Prototyping: Software Prototypen, Software entwickeln &amp; Programmieren im Team","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/rock-the-prototype.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/rock-the-prototype.com\/en\/#\/schema\/person\/fdb2f98edec62327712c2d26d981c081","name":"Sascha Block","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/967c419542686b085600443beafb2e55ad1ef6532a0ad9b96d244cb24fd8c117?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/967c419542686b085600443beafb2e55ad1ef6532a0ad9b96d244cb24fd8c117?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/967c419542686b085600443beafb2e55ad1ef6532a0ad9b96d244cb24fd8c117?s=96&d=mm&r=g","caption":"Sascha Block"},"description":"Ich bin Sascha Block \u2013 IT-Architekt in Hamburg und der Initiator von Rock the Prototype. Ich m\u00f6chte Prototyping erlernbar und erfahrbar machen. Mit der Motivation Ideen prototypisch zu verwirklichen und Wissen rund um Software-Prototyping, Softwarearchitektur und Softwareentwicklung zu teilen, habe ich das Format und die Open-Source Initiative Rock the Prototype geschaffen.","sameAs":["https:\/\/rock-the-prototype.com","https:\/\/www.instagram.com\/rock_the_prototype\/","https:\/\/x.com\/rocktheprototyp","https:\/\/www.youtube.com\/@Rock-the-Prototype\/"],"url":"https:\/\/rock-the-prototype.com\/en\/author\/administrator-2\/"}]}},"_links":{"self":[{"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/posts\/5756","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/comments?post=5756"}],"version-history":[{"count":8,"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/posts\/5756\/revisions"}],"predecessor-version":[{"id":5771,"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/posts\/5756\/revisions\/5771"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/media\/5767"}],"wp:attachment":[{"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/media?parent=5756"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/categories?post=5756"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rock-the-prototype.com\/en\/wp-json\/wp\/v2\/tags?post=5756"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}