pwnedkeys @pwnedkeys

I wonder whose Let's Encrypt account stopped working when the key in github.com/Netflix/lemur/… got deactivated. Perhaps I should get a list of active certificates from these accounts...

So it turns out that having a CA run the most popular cert lookup tool (crt.sh) isn't such a winning idea... if you use it to make them look bad, they'll block you from using it. Time to go build my own CT log scanner, I guess.

Somebody pulled a key out of github.com/letsencrypt/bo… and used it to register a production @letsencrypt account. 5 points for style, -1000000 points for WHAT THE WHAT?!?

Today in "@letsencrypt account private keys left in public places" news: encrypting your private keys is good, but using PEM format, with a password of "hoge" or "volcano", is... not so good.

If you know someone who is still encrypting their private keys with PKCS#1 ("PEM") format, please encourage them to stop doing that.

I think someone seriously misread the @letsencrypt docs... they put their LE *account* private key in .well-known/acme-challenge/<id>. How do I know this? Because they then pushed all that into a public github repo... 🤦‍♂️🤦‍♂️🤦‍♂️

I did a science! I requested revocation of several thousand publicly-trusted SSL certificates associated with approximately 1,200 private keys which had been pwned, and the report into how it went has now been posted to mozilla-dev-security-policy: groups.google.com/forum/#!topic/…

Dude, seriously, getting your cert revoked for key compromise is not going to be fixed by getting a new cert from a different CA. The key is pwned, man. Let it go. crt.sh/?spkisha256=83…

There's something suspiciously not right about this private key: used across multiple very different domains with different CAs, one cert revoked for "cessation of operation"... Sherlock hat time, methinks. crt.sh/?spkisha256=69…

Hey @avast_antivirus, are you OK with the entire Internet being able to MitM TLS connections to *.avast.com? Because that cert's still valid, and the private key is still available for download to anyone who wants it...

Matt Palmer @tobermatt

6 years ago

Hey @avast_antivirus, are you OK with the entire Internet being able to MitM TLS connections to *.avast.com? Because that cert's still valid, and the private key is still available for download to anyone who wants it...

1 1 3 0 0

This seems like an incredibly bad idea... github.com/DecipherNow/he…

You've got to admire the no-nonsense attitude of someone who just straight-up names a file "acme_account+key". github.com/shiliuus/GoSer…

I have 1,700+ (as yet) unrevoked certificates whose public keys were found on GitHub, and I endorse the Venetian approach.

Kelly Shortridge @swagitda_

6 years ago

I have 1,700+ (as yet) unrevoked certificates whose public keys were found on GitHub, and I endorse the Venetian approach.

7 218 606 0 23

Download Image

There is a strange feeling I get when I see a CA's own certificate get revoked for key compromise because they left the private keys laying around on GitHub... crt.sh/?id=1610038056… v1.pwnedkeys.com/02517173e05230…

Debian's removal of openssl-blacklist from its archive in 2017 because it was "obsolete" (tracker.debian.org/news/830695/re…) may have been a little premature... bugzilla.mozilla.org/show_bug.cgi?i…

Given how often it appears in the names of GitHub repositories that contain private keys for publicly-trusted certificates, I'm assuming that "ansible" is a native word meaning "this is a terrible idea". Can anyone confirm?

Would it be safe to assume that being able to MitM the Government Accountability Office would be a bad thing? crt.sh/?id=1166030780 v1.pwnedkeys.com/c7701317f3cdab…

Thanks to @alex_gaynor and his misissued.com service, you can now track the progress of CAs revoking certificates with provably-compromised private keys: misissued.com/batch/64

Ever wanted to MitM a cheese manufacturer? Now you can! crt.sh/?id=1983119014 v1.pwnedkeys.com/520473a2c8e9a0…

Weekly status check: "Found 1841 valid certificates that use pwnedkeys." 🤦‍♂️ level: MAXTREME