19 points | by deadliftdouche 20 hours ago
4 comments
eMudhra are now blocking access to their certificate revocation list URLs, so a MITM attacker using their certs with private key 4 keep working
It's almost like this is intentional. Weird.
Seems to me more like they've deployed some default WAF in front of their web properties, without considering the specific needs for the CRL endpoints.
The post indicates its a misconfigured WAF that's blocking automated tools/potential scrapers, not an overall block.
eMudhra are now blocking access to their certificate revocation list URLs, so a MITM attacker using their certs with private key 4 keep working
It's almost like this is intentional. Weird.
Seems to me more like they've deployed some default WAF in front of their web properties, without considering the specific needs for the CRL endpoints.
The post indicates its a misconfigured WAF that's blocking automated tools/potential scrapers, not an overall block.