← TrustAsia Technologies, Inc. cases
Bugzilla #2011713
Certificate Misissuance
TrustAsia: ACME Authorization Reuse Non-Compliance
RESOLVED
FIXED
TrustAsia Technologies, Inc.
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
TrustAsia Technologies, Inc. reported a vulnerability in their LiteSSL ACME service that led to the reuse of domain validation records across different ACME accounts, resulting in the misissuance of 143 DV certificates. The issue was identified on January 21, 2026, following a report from a community security researcher. TrustAsia suspended the ACME issuance service, revoked all affected certificates, and implemented a fix on the same day. A full incident report was subsequently published detailing the timeline, root causes, and remediation steps taken. The case has been resolved with all action items completed.
Chronology
- TrustAsia received a report indicating a vulnerability in their ACME service.
- All affected certificates were revoked and the service was restored.
- TrustAsia submitted a report closure summary detailing the incident and remediation.
Thread Activity
- TrustAsia Technologies, Inc. — Created preliminary incident report detailing the vulnerability and response.
- Community commenter — Questioned the timeline regarding the start of non-compliance.
- TrustAsia Technologies, Inc. — Submitted a full incident report with detailed findings and actions taken.
- TrustAsia Technologies, Inc. — Provided a report closure summary confirming completion of all action items.
Participants
TrustAsia Technologies, Inc.
Community commenter
CCADB representative
External References
Similar Local Cases
TrustAsia: SSL DV Mis-issuance against CP/CPS (IPAddress)
SSL.com: DCV bypass and issue fake certificates for any MX hostname
Chunghwa Telecom: OV TLS Server certificate issuance by GTLSCA without proper validation
Financijska agencija (Fina): Mis-issued certificates
Lawtrust: The S/MIME CA’s policy identifiers did not align with the CA/Browser Forum Requirements.
Certigna: Multiple Reserved Certificate Policy Identifiers in CA certificates
Telia: S/MIME Misissuance incorrect AIA id-ca-caIssuer http:URI
Chunghwa Telecom: Issuance of certificate using keys previously reported as compromised