Saturday, February 22, 2025
HomeSSL/TLSPrivate keys Leaked - 23,000 SSL Certificates to be Revoked Within Next...

Private keys Leaked – 23,000 SSL Certificates to be Revoked Within Next 24 Hours

Published on

SIEM as a Service

Follow Us on Google News

More than 23,000 SSL certificates that purchased through the reseller Trustico will be revoked today. The entire saga starts on February 2nd, 2018 when Trustico reached out to Digicert for mass revocation.

Trustico not has provided any details how the private key leaked or how did they acquire the keys,” says Jeremy Rowley from Digicert.

According to Trustico statement, they allow their customers to generate a certificate signing request and the private key at the time of ordering process. Then these generated private key will be stored cold storage for revocation purposes.

Trustico reached out to Digicert on February 2nd, 2018 requesting a mass revoke and Digicert asks Trustico to provide an evidence for the private key disclosure.

Later Trustico shares the private key along with the order numbers of the associated certificates in a zip file to DigiCert.

According to DigiCert statement on 2/27/2018 as Trustico provided proof of compromise and the private matches to the specific Trustico 23k customers which trigger’s the 24-hour revocation processing requirement under 4.9.1.1.3.

Digicert says as a CA, we had no choice but to follow the Baseline Requirements. Following our standard revocation process, we gave notice via email to each certificate holder whose private keys had been exposed to us by Trustico, so they could have time to get a replacement certificate.

Security researchers accused Trustico of logging private key of their customers “according to their statement they store the key for the revocation purposes” which is unfair and not required. Certificate Authorities and resellers should not hold the copies of the private key.

Customers and security researchers surprised and accused Trustico. Here are some tweets.

They advertised that “We don’t require a CSR” for Generating SSL Certificates.

There is a concern with warranty in the global community, the warranty is actually not for the one who purchases the SSL certificate. It applies only to the users who use the site secured by an SSL certificate.

Global sign, Rapid SSL trying to take some market advantage of the confusion caused.

Google Distrusting Symantec SSL Certificates is a separate issue and you can find more details about it here.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

SPAWNCHIMERA Malware Exploits Ivanti Buffer Overflow Vulnerability by Applying a Critical Fix

In a recent development, the SPAWNCHIMERA malware family has been identified exploiting the buffer...

Sitevision Auto-Generated Password Vulnerability Lets Hackers Steal Signing Key

A significant vulnerability in Sitevision CMS, versions 10.3.1 and earlier, has been identified, allowing...

NSA Allegedly Hacked Northwestern Polytechnical University, China Claims

Chinese cybersecurity entities have accused the U.S. National Security Agency (NSA) of orchestrating a...

ACRStealer Malware Abuses Google Docs as C2 to Steal Login Credentials

The ACRStealer malware, an infostealer disguised as illegal software such as cracks and keygens,...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

10 Best Free SSL Checker Tools 2024

SSL Checker helps you troubleshoot common SSL issues and SSL endpoint vulnerabilities. With the...

Google to Reduce SSL Certificate Lifespan to 90 Days

Recently, Google declared its plan to reduce the maximum validity for public TLS (SSL)...

Researchers Claim That RSA Algorithm Can Be Broken by Quantum Computers

It was recently reported that Chinese researchers had made a breakthrough in the field...