From FIPS to facepalm; when the chain of trust is compromised, everything that uses certificates for that trust has to be checked and updated – and that means everything.
When my editor asked me to quickly explain how much of a problem the eMudhra certificate kerfuffle really was, I thought that would be fairly straightforward because we had all the details. Turns out, the pot was still boiling over.
Probably the hardest part of explaining the impact of the eMudhra certificate kerfuffle was working out exactly how many things an enterprise has to update when the chain of trust stops being trustworthy; second hardest was keeping up with eMudhra's explanations and in the end, they just gave up
I talked last month about what a *well designed* key generation ceremony looks like: half precision, half bureaucracy. eMudhra gifted us the phrase "approved deviation" and it comes with a huge amount of work for a lot of US universities - and anyone who needs to care about security
props to @certkit.io for the details about the US universities that eMudhra is leaving with *even more* cleanup; no props to Oracle for tossing out that security update last night and burying the eMudhra connection in the footnotes
key signing
key mistakes
certificate revocation
chain of trust
certificate management
🤡👞