← Internet Security Research Group cases
Bugzilla #1853719
Certificate Problem Report
Once Revoked Let's Encrypt Certificate Actively Signing Malware
RESOLVED
INVALID
Internet Security Research Group
AI Summary
A user reported that an old Let's Encrypt CA certificate is being used to sign malware. The claim suggests that this certificate, which was previously revoked, is being bundled with malicious software. However, the Mozilla team indicated that there is insufficient evidence of a private key compromise, as the public certificate can be misused without indicating a vulnerability in the CA itself. The case was ultimately resolved as invalid due to lack of substantiated claims regarding the misuse of the private key.
Chronology
- User reported the misuse of a revoked Let's Encrypt certificate.
- Mozilla team indicated intent to close the case as invalid.
- Case officially closed as invalid.
Participants
lneubecker1972@gmail.com
bwilson@mozilla.com
External References
Similar Local Cases
Let's Encrypt: Expired ISRG Root OCSP X1 Certificate
Let's Encrypt: Early CRL Removal Incident
Let's Encrypt: Failure to revoke key-compromised certificate within 24 hours
Let's Encrypt: Certificates issued to Elliptic Curve Debian Weak Keys
Let's Encrypt: Non-BR-Compliant Certificate Issuance
Let's Encrypt: Issuance for Invalid Internationalized Domain Name
Let's Encrypt: Failure to revoke key-compromised certificates within 24 hours
Let's Encrypt: Potential Denial of Service against websites with broad private key reuse