Mitigating the eMudhra Intermediate CA Compromise with IBM i
This is a quick post in response to questions about the eMudhra Intermediate Certificate Authority Compromise. We will provide updates and more information as needed.
In this compromise, the private keys for the eMudhra certificate authority’s intermediate certificates were found to be very weak, enabling attackers to forge certificates and perform things like man-in-the-middle attacks. These keys can chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs, and by many downstream trust stores. Due to the scope of the intermediates breached, the recommendation by Mozilla and others is to pull the root that signed the intermediates. The vulnerability is more likely to affect server-to-server communication than browser applications.
This article provides a potential solution for IBM i that protects IBM i applications from being fooled by forged security certificates associated with this incident. Once applied successfully, applications using the updated certificate stores should reject those connections before exchanging sensitive information.
Please review and make sure the solution is suitable for your needs. Support clients are welcome to get in touch for personal assistance.
