Your MCU likely escaped the eMudhra intermediate CA compromise

WalterGR

Related: https://news.ycombinator.com/item?id=50166579 - “eMudhra intermediate CA compromise” - 947 points | 19 hours ago | 408 comments https://news.ycombinator.com/item?id=50177916 - "Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds" - 604 points | 7 hours ago | 270 comments

scottlamb

tl;dr: MCUs are space-constrained and often don't include root certs that aren't used by the one host they talk to. In my experience it's equally likely they just don't do validation to begin with. For example, my Elk M1XEP (physical security system's Ethernet expander) runs a configuration server with and without TLS. They recommend with, but it uses a self-signed certificate, and the crappy VB.NET configuration program doesn't validate the cert in any way, so it can be trivially MITMed. The Elk M1XEP also can connect to a user-chosen alarm monitoring service ("central station") over the Internet. I don't think it uses TLS at all for this. I think there's optional shared secret auth/encryption?

tomku

Your device would also have to be pretty recent to ship any of these certs in a frozen cert store as they were only generated in April/May of 2025.

foobarian

I must have missed when de facto definition of MCU started including being on the network and doing crypto :-)

tgsovlerkhgsel

TL;DR: Your MCU likely doesn't have enough space to dedicate so much of it to a full CA store, so it is unlikely to trust those CAs (claims the post). So many words for such a simple point/claim...

hasheddan

Fun fact: esp-idf includes an x509 Certificate Bundle API[0] that will pull in the entire Mozilla trust store by default. However, they will be stripped unless firmware calls `esp_crt_bundle_attach`. There is an issue[1] tracking removal of the eMudhra root CA certificate. [0] https://docs.espressif.com/projects/esp-idf/en/latest/esp32/... [1] https://github.com/espressif/esp-idf/issues/19282

6thbit

So MCUs or any embedded that doesn't get updates will likely only be good for up to the validity of the included CA root before bricking up? These days thats up to 15 years. Talk about programmed obsolescence.

bawolff

> Mozilla has maintained a dedicated CA Certificate Program since the initial launch of Firefox umm, they had already been maintaining the program for almost a decade at that point.