---
title: "Discussion on \"Remediating the eMudhra Certificate Authority Compromise\" | Hashnode"
description: "Discussion on \"Remediating the eMudhra Certificate Authority Compromise\". The number 4️⃣ strikes again! What users can do about it."
url: "https://hashnode.com/posts/remediate-emudhra-compromise/6adb7de8998dc4e227bcc277"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Remediating the eMudhra Certificate Authority Compromise](https://kevinhwang.dev/remediate-emudhra-compromise?utm_source=hashnode&utm_medium=feed)

The number 4️⃣ strikes again! What users can do about it.

Oct 23 · 5 min read · kevinhwang.dev  
Read the article

-   [#emudhra](https://hashnode.com/tag/emudhra)
-   [#pki](https://hashnode.com/tag/pki)
-   [#cryptography](https://hashnode.com/tag/cryptography)
-   [#ubiquiti](https://hashnode.com/tag/ubiquiti)
-   [#unifi](https://hashnode.com/tag/unifi)
-   [#security](https://hashnode.com/tag/security)

## Written by

[Kevin Hwang](https://hashnode.com/@kevinhwang)

@kevinhwang

  
[View profile](https://hashnode.com/@kevinhwang)

Señor Vibe Coder

## Responses 2

Markdown supported · ⌘↵ to post

[Angela Rodriguez](https://hashnode.com/@angelarodriguez)

[5d ago](https://hashnode.com/posts/remediate-emudhra-compromise/6adb7de8998dc4e227bcc277/comment/6af14f55922148e5e7496783)

Great insights on the eMudhra situation! It’s crucial to prioritize transparency in these compromises. I'm curious if you think stronger regulatory measures could've helped prevent this? Thanks for shedding light on a complex topic! [pips](https://pipshint.io/)

[Abhinav Sharma](https://hashnode.com/@abhinavs1920)

[Oct 24](https://hashnode.com/posts/remediate-emudhra-compromise/6adb7de8998dc4e227bcc277/comment/6adbf5cd78f53e928ea38b86)

The point about distrusting the roots rather than just the compromised intermediates is the part most writeups miss: a server can present the intermediate alongside any leaf it signs, so removal at the intermediate level changes nothing while the root stays trusted. And CRL and OCSP being honored mostly only by browsers explains why the fix had to be explicit blocklists all the way down the stack.