Topic
tls
Certificates, trust stores and TLS libraries: lifetimes, CA incidents and library upgrades, with commands to inventory what a fleet actually uses.
3 engineering notes.
- eMudhra CA compromise: eight intermediate keys anyone could recoverEight eMudhra intermediate CA keys were generated with almost no randomness. What happened, which root was distrusted, and which clients stayed exposed after browsers were fixed.
- OpenSSL 4.0 is current: find the copies your services actually loadOpenSSL 4.0 shipped in April 2026 and 4.1 in October. A probe that finds the OpenSSL builds linked into running services, not the one on PATH.
- TLS certificates are getting shorter: 200 days now, 100 days in 2027The 200-day maximum is already in force, Let's Encrypt moves to 64-day and then 45-day certificates, and hardcoded renewal intervals need to change now.
Related service: Infrastructure Assessment →
