KKazem Mortazavi3d ago · 2 min readA CA Key With 256 Possible Values: Lessons From the eMudhra IncidentThe padlock in the address bar rests on a chain: a site certificate is signed by an intermediate certificate authority, which is signed by a root that the operating system trusts. This month we learnesecurityland.hashnode.dev
KKevin HwangOct 23 · 5 min readRemediating the eMudhra Certificate Authority CompromiseOn Oct 20, 2026, it was publicly disclosed that several eMudhra certificate authority certificates were compromised. ‼️ There was a bug in eMudhra's key generation ceremony that caused them to be gene1Akevinhwang.dev
VVictor Chukwuemeka OnwuegbuchulemAug 14 · 18 min readTLS and Certificates: How Two Strangers Agree on a Secret, and Why Your Browser Trusts AnyoneLast post ended with a promise. We had explained that HTTPS is ordinary HTTP running inside an encrypted tunnel called TLS, Transport Layer Security, and that this tunnel provides confidentiality, intvictor-chukwuemeka.hashnode.dev
RRenukashree MuraliJul 16 · 6 min readBuilding a PKI From Scratch, Part 4: Revocation and the CRLWhat this does The final part of building a Public Key Infrastructure by hand with Python and OpenSSL. Parts 1–3 built a working three-tier trust chain and issued a real server certificate. This part quietbytes.hashnode.dev
RRenukashree MuraliJul 15 · 6 min readBuilding a PKI From Scratch, Part 3: Issuing a Certificate and Proving the Chain WorksWhat this does Part 3 of building a Public Key Infrastructure by hand with Python and OpenSSL. Parts 1 and 2 built the Root and Intermediate CAs - pure trust-establishment, nothing signed anything reaquietbytes.hashnode.dev
RRenukashree MuraliJul 15 · 6 min readBuilding a PKI from Scratch, Part 2: The Intermediate CAWhat this does Part 2 of building a Public Key Infrastructure by hand with Python and OpenSSL. Part 1 covered the Root CA - a self-signed trust anchor. This part covers the Intermediate CA: a second cquietbytes.hashnode.dev
RRenukashree MuraliJul 13 · 6 min readBuilding a PKI From Scratch, Part 1: The Root CAWhat this does I'm building a complete Public Key Infrastructure by hand - a Root Certificate Authority, an Intermediate CA, end-entity certificate issuance, revocation, and CRL generation - using Pytquietbytes.hashnode.dev
PPadmanabhan VenkitasubramanianMay 14 · 3 min readBouncyCastle X.509 Certificate Extensions in Java: A Subtle Encoding TrapIntroduction If you’ve ever wrangled certificates in Java, you know the standard JDK APIs only go so far. Most real-world setups lean on BouncyCastle, especially when you need flexibility with buildintvpadmanabhan.hashnode.dev
NnineMay 2 · 10 min readmTLS in Production: A Hands-On Guide to Service-to-Service Authentication Without the FootgunsMutual TLS (mTLS) authenticates both sides of a service-to-service connection using cryptographic certificates, blocking lateral movement and service impersonation inside your network. After being on-call for NTP-drifted VMs rejecting handshakes at 3...certpulse.hashnode.dev
JJay PrakashApr 19 · 4 min readEndpoint Encryption Enforcement: Building a Repeatable Control That Actually SticksEndpoint encryption is not a complex technical problem. It is an execution problem. Most environments have BitLocker enabled on some machines, enforced inconsistently, with no centralized key escrow and no reliable reporting on what is actually encry...0daychronicles.hashnode.dev
