Once Revoked Let's Encrypt Certificate Actively Signing Malware

The bug was opened with an allegation that an older Let’s Encrypt certificate (and an alternate version) is “actively signing malware.” The reporter provided VirusTotal relations and other references, and argued that the certificate should not be reintroduced to public trust. Mozilla CA Program staff asked for evidence of private key compromise or misuse, noting that public certificates can be copied and misused and that the primary concern is private key handling and use. After reviewing the references provided, Mozilla staff stated they still could not identify any CA-related vulnerability, exploit, or threat, and suggested the allegation was unsubstantiated. The bug was intended to be closed as Invalid, and the current resolution is INVALID. The thread also includes additional links and discussion from the reporter, but Mozilla staff continued to request a CA-related concern beyond public bundling with malware.

1. 2023-09-18 A bug was filed alleging that a Let’s Encrypt certificate is being used to sign malware.
2. 2023-09-22 Mozilla staff indicated an intent to close the bug as Invalid.
3. 2023-10-26 The bug was resolved as INVALID.

1. 2023-09-18 Community commenter — Filed the report claiming an old Let’s Encrypt CA/certificate is actively signing malware and provided VirusTotal and other references.
2. 2023-09-18 Mozilla representative — Asked for evidence of private key compromise or misuse and said the allegation about malware signing was unsubstantiated based on public certificate bundling.
3. 2023-09-22 Mozilla representative — Stated an intent to close the bug on Wed 27-Sep-2023 as Invalid.
4. 2023-10-09 Community commenter — Responded with additional links and references, including a related older Bugzilla thread and other web pages.
5. 2023-10-09 Mozilla representative — Said they still could not identify any CA-related vulnerability, exploit, or threat and asked what other concern existed.
6. 2023-10-10 Community commenter — Added more references and argued that previously revoked certificates being distributed by malware is significant.
7. 2023-10-10 Community commenter — Provided a Mozilla TLS Observatory certs/description link for the ISRG Root X1 certificate.