[Gerald Combs <gerald@xxxxxxxxxxxxx>]

Hi all,

You're probably aware that the private keys of several intermediate TLS certificates have been compromised. While the issue appears to be largely fixed at the OS level, a lot of software in use potentially uses private certificate stores instead of the OS-provided ones and might be vulnerable to MitM attacks. This includes git, CMake, curl, and other tools that we use for Wireshark development. In the interest of keeping our local development environments safe, I've compiled the following list of checks for various software and utilities. Feel free to respond to this with additions or corrections.

Your browser(s):

Load https://emudhra.we-have-a-problem.com/#check and look for green checkboxes.


git:

Run following commands[1] and ensure that they fail:

git ls-remote https://g3.emsign.filippo.io
git ls-remote https://aaa.emsign.filippo.io

(I had to run `git config --global http.sslBackend schannel` on Windows to get these to fail properly; your mileage may vary.)


CMake:

Save the attached script and run it, e.g. `cmake -P /tmp/eMudhra.cmake`.


Curl:

We don't use curl directly in our development environment, but it's still common enough to check. The following commands should fail, similar to the git commands above.

curl https://dv-g3b-emudhra.we-have-a-problem.com/
curl https://dv-g3b-aaa-emudhra.we-have-a-problem.com/


1. Modified from https://bsky.app/profile/filippo.abyssdomain.expert/post/3myf6i2hdkk2u

# Check to see if CMake trusts eMudhra certificates
# Usage: `cmake -P eMudhra.cmake`.
# This leaves dv-g3b.txt and dv-g3b-aaa.txt behind; you'll have to remove
# those by hand.

file(DOWNLOAD
    https://dv-g3b-emudhra.we-have-a-problem.com/
    dv-g3b.txt
    STATUS download_status)
list(POP_FRONT download_status download_retval)

# CMake on Windows returns 35. It returns 60 on macOS.
if (${download_retval} EQUAL 35 OR ${download_retval} EQUAL 60)
    message(STATUS "Hooray! You don't trust emSign ECC Root CA - G3")
elseif (${download_retval} EQUAL 0)
    message(WARNING "You still trust emSign ECC Root CA - G3")
else()
    message(STATUS "Unknown status for emSign ECC Root CA - G3: ${download_status}")
endif()

file(DOWNLOAD
    https://dv-g3b-aaa-emudhra.we-have-a-problem.com/
    dv-g3b-aaa.txt
    STATUS download_status)
list(POP_FRONT download_status download_retval)

if (${download_retval} EQUAL 35 OR ${download_retval} EQUAL 60)
    message(STATUS "Hooray! You don't trust AAA Certificate Services")
elseif (${download_retval} EQUAL 0)
    message(WARNING "You still trust AAA Certificate Services")
else()
    message(STATUS "Unknown status for AAA Certificate Services: ${download_status}")
endif()