eMudhra CA compromise

[robertblue 0]

Several certificates managed by a company called eMudhra have been compromised recently, making it possible for an attacker to fake SSL certificates without the user noticing, assuming of course they are on an outdated browser or system.
Is AirVPN affected by this?

[SeUbHS 3]

I'd like to know this as well.

[Staff 10687]

Hello!

AirVPN is not affected.

All our websites and web services (airvpn.org and our other domains) use Let's Encrypt certificates, which chain to ISRG Root X1. No eMudhra root or intermediate certificate is part of any of our certificate chains.

The VPN connections do not depend on public certificate authorities at all:

• OpenVPN: your client authenticates our servers only against AirVPN's own private CA, which is included in your configuration file. A certificate issued by any public CA, eMudhra included, is rejected.
• WireGuard: there are no certificates. The server is authenticated by its public key, which is also in your configuration file.
• Eddie: it communicates with our infrastructure through a channel encrypted and authenticated with an RSA key built into Eddie itself, so it does not rely on the certificate store of your system.

Since the tunnel is authenticated this way, someone on your local network or at your ISP cannot use a forged public certificate to get between you and our VPN servers.

The remaining risk is the general one that applies to every website: a person who holds one of the compromised intermediate keys could forge a certificate for any domain, and a browser or operating system that has not received the block could accept it. Mozilla, Google, Apple and Microsoft have already revoked and blocked the affected certificates, thus upgrade asap.

Kind regards