13 points | by deadliftdouche 4 hours ago
3 comments
eMudhra are now blocking access to their certificate revocation list URLs, so a MITM attacker using their certs with private key 4 keep working
It's almost like this is intentional. Weird.
Seems to me more like they've deployed some default WAF in front of their web properties, without considering the specific needs for the CRL endpoints.
eMudhra are now blocking access to their certificate revocation list URLs, so a MITM attacker using their certs with private key 4 keep working
It's almost like this is intentional. Weird.
Seems to me more like they've deployed some default WAF in front of their web properties, without considering the specific needs for the CRL endpoints.