“The harder finding for many organizations will be that they can’t answer these questions at all,” Grover said, referring to where certificate trust decisions are made outside browsers and operating systems.
Grover noted that Google reported finding no certificates chaining to the affected intermediates in Certificate Transparency logs before they were blocked. She said that was reassuring for clients that enforce Certificate Transparency, but some non-browser applications and devices do not. Exploitation would also require an attacker to be positioned to intercept traffic, she said, describing the remaining risk as limited and targeted rather than broad.
Azul, a Java vendor, said in a statement that Java does not check certificate revocation by default. An unpatched Java Development Kit (JDK) could therefore continue to accept a forged certificate signed with a compromised intermediate key if the relevant chain remains trusted.
