Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.
exploiting compromised certificates requires an active adversary-in-the-middle attack, meaning the attacker must act as a proxy between two TLS parties and receive encrypted traffic, decrypt it, reencrypt it, and send it to the other party. Such capabilities, in some cases, are usually limited to only the most well-resourced attackers. People with control of a local network—at a coffee shop, university, or other organization—face much less of a challenge.
https://emudhra.we-have-a-problem.com/
if the keys are compromised, the CA is considered compromised until it is updated. from a black-box perspective this is not different from the CA’s keys being leaked.
Not quite.
From: https://arstechnica.com/security/2026/10/hackers-obtain-counterfeit-tls-certificates-for-google-and-other-large-services/:
This did not happen like the verisign compromise, where someone posed as a Microsoft employee and got certs with Microsoft’s name on them, which was a problem for all other Microsoft certs for servers and clients.
i think we’re talking different definitions of compromised here. the end result either way is bad actors have all the certs. what credentialing system does your voting system require of the authorities?