eMudhra CA compromise check

Uses .NET to read the chain the server sends. It doesn't validate it, so it also works when the chain is already blocked.

$h='www.example.com'; $t=New-Object Net.Sockets.TcpClient($h,443); $s=New-Object Net.Security.SslStream($t.GetStream(),$false,{param($a,$c,$ch,$e) $global:raw=@(,$c.GetRawCertData()) + @($ch.ChainElements | select -Skip 1 | % { ,$_.Certificate.RawData }); $true}); $s.AuthenticateAsClient($h); $global:raw | % { "-----BEGIN CERTIFICATE-----`n"+[Convert]::ToBase64String($_,'InsertLineBreaks')+"`n-----END CERTIFICATE-----" } | Set-Clipboard; $t.Close()

Drop or choose a .pem, .crt or .cer file (PEM or DER) below. On Windows, export from certlm.msc as Base-64 encoded X.509 or DER; both work.

Tests the system bundle, Python certifi, Node.js, Java cacerts, Git and SSL_CERT_FILE-style overrides with openssl verify. It also scans nginx, Apache, HAProxy, Caddy and Let's Encrypt folders for eMudhra certificates. Run it with sudo so it can read the certificate folders. Add --path DIR for other locations.

Add --deep to find vulnerable apps, not just the system. It sweeps /opt, /srv, /usr/local, /usr/lib, /usr/share, /var/lib, /home, /root and /Applications. There it tests every CA bundle an app ships (every Python certifi and virtual environment included) and every Java runtime's cacerts. It also lists Electron apps and Go programs with the Go version each was built with. It only reads files and never runs what it finds; expect a few minutes.

curl -fsSLO https://scan.theadminstack.com/emudhra/scripts/emudhra-check.sh
less emudhra-check.sh            # review it
sudo bash emudhra-check.sh --deep  # drop --deep for a quick scan; add --online to test curl

Asks Windows to build a chain for three of the compromised CAs: TLS via the emSign root, TLS via the Sectigo cross-sign, and code signing. It counts the 16 certificates in Untrusted Certificates and reads when the automatic root list last synced. It then checks bundles that bypass Windows (Python certifi, Node.js, Java, Git with OpenSSL), the machine and IIS certificate stores, and, with -CodeSigningScan, Authenticode signatures. Run it from an elevated PowerShell.

Add -Deep to find vulnerable apps. It sweeps Program Files, Program Files (x86), ProgramData, C:\Python* and per-user installs (AppData\Local\Programs, AppData\Local\pipx, AppData\Roaming\Python). There it tests every CA bundle an app ships and every Java runtime's cacerts, and lists Electron apps and Go programs with the Go version each was built with. Add folders with -Path. It reads file headers only; expect a few minutes.

$b = 'https://scan.theadminstack.com/emudhra'
Invoke-WebRequest "$b/scripts/emudhra-check.ps1" -OutFile emudhra-check.ps1
Invoke-WebRequest "$b/certs/emudhra-compromised.p7b" -OutFile emudhra-compromised.p7b   # test certificates
notepad .\emudhra-check.ps1      # review it
# from an elevated PowerShell (drop -Deep for a quick scan; add -Online or -CodeSigningScan 'C:\Program Files'):
Unblock-File .\emudhra-check.ps1
Set-ExecutionPolicy -Scope Process RemoteSigned
.\emudhra-check.ps1 -Deep | Set-Clipboard

Keep both files in the same folder. The .p7b holds the public certificates of the 16 compromised CAs; the script asks Windows to build a chain for three of them.

Base images carry their own CA bundle, frozen when the image was built. Run the Linux check inside each image you ship. The container needs bash and openssl; slim and distroless images may have neither, in which case rebuild on an updated base image.

curl -fsSLO https://scan.theadminstack.com/emudhra/scripts/emudhra-check.sh
for img in $(docker ps --format '{{.Image}}' | sort -u); do
  docker run --rm --entrypoint bash -v "$PWD/emudhra-check.sh:/c.sh:ro" "$img" /c.sh --no-cert-scan 2>/dev/null \
    | sed "s/^hostname=.*/hostname=$img/"
done