周二，全球安全人员处于高度戒备状态，此前发现了 8 张 TLS 证书，其私钥极其薄弱，可能允许任何人为互联网上的任何网站铸造受信任的浏览器和应用凭据。
Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet.
截至周二上午晚些时候，浏览器制造商以及一些主要应用和编程语言已封锁了所有 8 张中间证书。证书透明度日志（记录所有受浏览器信任证书的签发情况）目前未显示这些被攻破的密钥被恶意使用。然而，威胁远未结束，因为更新互联网的其他关键部分（如 Linux 发行版、嵌入式设备和物联网设备）将既困难又耗时。
As of late morning Tuesday, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates. There are no reports of certificate transparency logs, which track the issuance of all browser-trusted certificates, showing the compromised keys being used maliciously. The threat remains far from over, however, because it will be hard and time-consuming to update other key parts of the Internet, such as Linux distributions and embedded and Internet-of-things devices.
这 8 张中间证书属于总部位于印度的证书颁发机构 eMudhra Limited。周末，一个非正式通告发布在 emudhra.we-have-a-problem.com 上，内容为“我们有麻烦了——韦恩”。该消息使用其中一张 eMudhra 证书的私钥进行了数字签名。由于有证据证明报告方掌握了该密钥，防御者迅速采取行动，因为同一密钥可用于签署未经授权的证书，而这些证书会被全球数百万台服务器信任。
The eight intermediate certificates belong to India-based certificate authority eMudhra Limited. An informal advisory published to emudhra.we-have-a-problem.com over the weekend posted the message “We have a problem here - Wayne.”The words were digitally signed using the private key of one of the eMudhra certificates. With proof that the reporting party had control of the key, defenders scrambled because the same key could be used to sign unauthorized certificates that would be trusted by millions of servers around the world.