Zerot

Those keys are the private keys of 8 intermediate certificates. With those keys you can sign any certificate and from a browser(or any other app the consumes TLS) it will look like it was signed by the official intermediate certificate.

So yeah, an attacker could sign fake certificates for any site and pretend to be signed by the trusted eMudhra CA. It requires MitM.

As for revoking a cert, there are a few ways, but none of them are fully reliable. This works by having revocation list endpoints that list all the revoked certificates. Which is why you should already be fine if you are using a desktop browser(mobile could still be outdated). But for IoT devices, they tend to both not check the revocation lists, and not get updates to remove the compromised root. As a result we might have issues with this for a long time.

This is also why there has been a big push to have short expiry times for certificates in the industry for multiple years now. Because with shorter lifetimes, the open window for using a compromised certificate is limited.

The almost universal standard around the world is between 15 and 16 years old

You might want to check that, because if you look at the list of minimum driving ages on Wikipedia you will see that most countries have a minimum of 18 for cars.

Because it’s not a security issue? It is a bug that would affect long running MacOS machines which is quite low impact.

No. This is a different archive site