Update, 25 October, 12:30 UTC: it’s done. Every website we host, our apps and services, and the main server that holds the databases now use the corrected list of trusted issuers. The only exception is one older app that’s about to be retired. We checked every running copy of each one, and the broken issuer is gone from all of them. WordPress sites now check secure connections against the server’s list, which we keep up to date, rather than WordPress’s own copy. There’s nothing you need to do.
You wait ages for a security story, then three come along at once. On 20 October one of Google’s London data centres lost power (your site stayed up). On 21 October PHP, the language WordPress is written in, released an emergency security fix. And this week it’s the turn of the padlock in your browser’s address bar.
What Happened
The padlock works because a small number of trusted companies, called certificate issuers, vouch for each website. Every browser and every server carries a list of the issuers it trusts. One of them, a company called eMudhra, turned out to have created eight of its signing keys so carelessly that anyone could work them out. With those keys, someone could make a padlock for any website, including one pretending to be your bank, and the browser would believe it.
A researcher reported the problem on 17 October. Chrome and Firefox blocked the affected keys within hours, and eMudhra has since said it will leave the business. Nobody has reported any attack using the keys. Cloudflare’s write-up has the technical detail.
Your Site and Your Visitors Are Fine
- Your padlock doesn’t come from eMudhra. Every site we host gets its padlock from Google, which renews it automatically. Nothing about it changes.
- Your visitors are already protected. Their browsers have been updated to reject anything signed with the broken keys.
Where It Does Touch Us
Your site doesn’t only receive visitors. It also makes its own secure connections out to other services: WordPress checking for updates, your contact form sending an email, the spam check on a form, our booking and school apps taking a card payment. Each of those connections checks the other side’s padlock against our servers’ own list of trusted issuers, and on some of our servers that list still includes eMudhra.
To take advantage of that, an attacker would need to get in between our servers and the service they’re talking to, inside Google’s network. That’s very hard to do, and there’s no sign of anyone trying. But “very hard” isn’t the same as impossible, so we’re fixing it this week.
What We’re Doing This Week
- Updating every list. We’re rebuilding our apps and services with the corrected list of trusted issuers, and updating the main server that holds the databases. Every site runs as at least two copies and we update them one at a time, so you shouldn’t notice.
- Fixing WordPress’s own list. WordPress carries its own private copy of the list, separate from the server’s, and WordPress hasn’t released a corrected one yet. Rather than wait, we’re telling every WordPress site we host to use the server’s list, which we keep up to date. That also means the next time an issuer is struck off, your site is covered as soon as we update, with no waiting for a WordPress release.
- Checking every copy. Once it’s done, we’ll check every running copy of every site and app to confirm the broken issuer has gone from its list, and update this post.
The Honest Bit
Until the work is finished, the old list is still in place on some of our servers. We think the risk in the meantime is very small: it needs an attacker inside Google’s own network, and the services we talk to are well known and closely watched. If anything changes, such as reports of the keys actually being used, we’ll do the work straight away instead of waiting.
What This Means for You
- No action needed. There’s nothing for you to install or change.
- Your padlock and your visitors are unaffected.
- We’ll update this post when every server has the corrected list.
Not hosted with us? Ask your host whether their servers, and any WordPress sites they run, still trust eMudhra. It’s a quick check for anyone who knows where to look. If the answer is vague, send us a login or an export: we copy the site, test it privately, then switch your domain. The first migration is free.
If you have any questions about your own site, get in touch.