“This isn’t just about eight compromised keys. It’s about the global internet’s chain of trust,” Kadakia said. “A single authority’s failure can undermine authentication for organisations that have never dealt with it.”
Kadakia said enterprise security teams should check payment gateways, vendor integrations, older Java applications, mobile apps, and network appliances, which may use certificate trust stores separate from browsers.
“Security teams need to identify both the certificates their services present and the certificate authorities their applications trust,” he said. He advised organizations to test whether affected clients reject certificates signed by the compromised keys, including cross-signed chains.
This story originally appeared on Computerworld
