eMudhra are now blocking access to their certificate revocation list

Comments

Comment by deadliftdouche 1 day ago

eMudhra are now blocking access to their certificate revocation list URLs, so a MITM attacker using their certs with private key 4 keep working

Comment by topham 1 day ago

It's almost like this is intentional. Weird.

Comment by rmccue 1 day ago

Seems to me more like they've deployed some default WAF in front of their web properties, without considering the specific needs for the CRL endpoints.

Comment by pseudohadamard 1 day ago

The post indicates its a misconfigured WAF that's blocking automated tools/potential scrapers, not an overall block.