Post

The eMudhra intermediate CA compromise broadly impacts the atproto ecosystem. At this point lots of software has been patched, and we recommend upgrading if you run a distribution of the relay, pds, jetstream, or use the goat CLI. For general information see the site linked below, otherwise read on.

We have put together DID and handle resolution vectors that you can use to check if software you run may be vulnerable. The following handle should _not_ resolve to a DID: '@emudhra.divy.zone' The following DID should _not_ resolve to a DID document: 'did:web:emudhra.divy.zone'

Both resolutions should fail with TLS/SSL errors: ``` $ goat resolve emudhra.divy.zone error: handle resolution failed: HTTP well-known request error: Get "https://emudhra.divy.zone/.well-known/atproto-did": tls: failed to verify certificate: x509: certificate signed by unknown authority ```

Updating operating system CA bundles is recommended, but they don't impact containerized environments (e.g. Docker). And lots of software does not inherit from the OS by default.