Microsoft DSRE PKI: Microsoft shares wildcard certificates among cloud instances

This case involves Microsoft sharing wildcard certificates among its cloud instances, which resulted in a security vulnerability where the private key could be extracted by users. The issue was initially reported by Matthias Gliwka, who discovered that multiple customer instances were using the same wildcard certificate and private key, leading to potential unauthorized access. Microsoft was informed and began investigating the issue. The certificates were eventually revoked, and the case was marked as resolved. Further actions regarding the certificates were discussed, including potential updates to OneCRL.

1. 2017-11-29 Initial report of shared wildcard certificates leading to private key exposure.
2. 2017-12-05 Microsoft confirmed revocation of the affected certificates.

1. 2017-11-29 Hboeck representative — Reported a problem with Microsoft involving a certificate whose private key is essentially public.
2. 2017-11-30 Microsoft Corporation — Microsoft is investigating this issue.
3. 2017-12-02 Mozilla representative — Microsoft representatives informed that they are actively engaged on this issue.
4. 2017-12-05 Mozilla representative — Closing as resolved fixed, per email from Microsoft.