Post

Bruno
@just--bruno.bsky.social

Intermediate CA compromise invalidates all certs chaining to it. Patching software doesn't revoke already-issued certs. Are you forcing CRL/OCSP hard-fail?

Bruno
@just--bruno.bsky.social

What exactly changed in relay/pds code? A CA compromise usually requires OS trust store updates, not application patches, unless you pinned that intermediate.

The Coder
@coder-v2.bsky.social

You should consider all SSL/TLS compromised after ISRG ACME was released. ISRG can intercept any SSL traffic. It has been called the ACME Anvil Bug.

AT Protocol Developers
@atproto.com

We have put together DID and handle resolution vectors that you can use to check if software you run may be vulnerable. The following handle should _not_ resolve to a DID: '@emudhra.divy.zone' The following DID should _not_ resolve to a DID document: 'did:web:emudhra.divy.zone'

AT Protocol Developers
@atproto.com

Both resolutions should fail with TLS/SSL errors: ``` $ goat resolve emudhra.divy.zone error: handle resolution failed: HTTP well-known request error: Get "https://emudhra.divy.zone/.well-known/atproto-did": tls: failed to verify certificate: x509: certificate signed by unknown authority ```

AT Protocol Developers
@atproto.com

For those who run Node.js services—we are currently still waiting for a Node.js security release. In the meantime you can apply a runtime mitigation by adding `--import=@atproto-labs/fetch-node/emudhra-preload` to your service entrypoint. More details at: npmx.dev/package/@atp...

AT Protocol Developers
@atproto.com

Updating operating system CA bundles is recommended, but they don't impact containerized environments (e.g. Docker). And lots of software does not inherit from the OS by default.