eMudhra is also a root CA operator. One root CA operator cross-signing another root CA operator is a good thing actually, and it's what allowed Let's Encrypt to work before their root certificate was widely trusted.

Issuing sub CAs to non-root operators has historically been a big loophole though it's not as bad these days since multiple root programs now require approval before CAs can do it.

▲

sippingabonedry a day ago | parent [-]

Didn't Let's Encrypt have to jump through all sorts of hoops to prove they were competent and trustworthy before that happened?

Now it's coming out these guys used "4" as a private key. That's a crazy amount of incompetence and malfeasance. Did they vibe-code a CA? HOW DOES THIS HAPPEN? I am dumbfounded.

You couldn't even do this if you installed Microsoft Small Business Server 2008 today, unpatched, with the CA on default settings.

	▲	agwa a day ago \| parent [-]
		eMudhra had to jump through even more hoops. Obviously the system failed here, but it's a failure of a root certificate operator, not a sub-CA operator as claimed by eqvinox.