A deep dive (link below ): "remediated by Mozilla, Microsoft, Apple, and Chrome for their users through their tools for distributing revocation information such as [OneCRL](https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/), [CRLite](https://hacks.mozilla.org/2025/08/crlite-fast-private-and-comprehensive-certificate-revocation-checking-in-firefox/) and [CRLSets](https://www.chromium.org/Home/chromium-security/crlsets/)." https://emudhra.we-have-a-problem.com/ Richard Leir Happy Canoeing and Hiking and Biking! Sent from [Proton Mail](https://proton.me/mail/home) for Android. -------- Original Message -------- On Saturday, 10/24/26 at 08:08 Rick Leir via linux <linux [ at ] linux-ottawa [ dot ] org> wrote: > The other day I commented on http security but I was too oblique. Specifically, there's an issue with the Indian registrar that made it possible for a hacker to impersonate any https site. Until you update your browser. > But would the hacker need to subvert dns at the same time? > > https://www.theregister.com/security/2026/10/20/indian-certification-authority-emudhras-private-keys-compromised-one-of-them-was-the-number-4/5304312 > > Richard Leir > Happy Canoeing and Hiking and Biking! > > Sent from [Proton Mail](https://proton.me/mail/home) for Android.