Your MCU Likely Escaped the eMudhra Intermediate CA Compromise

Your device would also have to be pretty recent to ship any of these certs in a frozen cert store as they were only generated in April/May of 2025.

Related:

https://news.ycombinator.com/item?id=50166579 - “eMudhra intermediate CA compromise” - 947 points | 19 hours ago | 408 comments

https://news.ycombinator.com/item?id=50177916 - "Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds" - 604 points | 7 hours ago | 270 comments

I must have missed when de facto definition of MCU started including being on the network and doing crypto :-)

tl;dr: MCUs are space-constrained and often don't include root certs that aren't used by the one host they talk to.

In my experience it's equally likely they just don't do validation to begin with. For example, my Elk M1XEP (physical security system's Ethernet expander) runs a configuration server with and without TLS. They recommend with, but it uses a self-signed certificate, and the crappy VB.NET configuration program doesn't validate the cert in any way, so it can be trivially MITMed. The Elk M1XEP also can connect to a user-chosen alarm monitoring service ("central station") over the Internet. I don't think it uses TLS at all for this. I think there's optional shared secret auth/encryption?

TL;DR: Your MCU likely doesn't have enough space to dedicate so much of it to a full CA store, so it is unlikely to trust those CAs (claims the post).

So many words for such a simple point/claim...