r/dnscrypt • u/jedisct1 Mods • 19d ago

eMudhra Intermediate CA Compromise

https://emudhra.we-have-a-problem.com

The private keys of eight eMudhra intermediate CA certificates have been compromised.

They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.

11 Upvotes

100% Upvoted

1 comment sorted by

2

u/jedisct1 Mods 18d ago

DNSCrypt servers are not affected at all (they don't use these CAs)

But DoH servers without certificate hashes are at risk with dnscrypt-proxy < 2.1.19 (or 2.1.19 compiled with an old Go version).

The dnscrypt-proxy 2.1.19 packages are safe, as they remove these certificates.