TrustAsia Revokes 143 Certificates After LiteSSL ACME Validation Reuse Flaw

TrustAsia revoked 143 SSL/TLS certificates after identifying a vulnerability in its LiteSSL ACME issuance service that enabled improper reuse of domain validation artifacts across different ACME accounts. The issue, tracked in Mozilla Bugzilla #2011713, led TrustAsia to suspend ACME issuance, investigate scope, and perform a mass revocation of impacted certificates issued via ACME after 2025-12-29; TrustAsia reports the service has been patched and restored.

Technical reporting indicates the root cause was a logic/authorization handling failure in LiteSSL’s ACME implementation: the system did not reliably ensure that a certificate request (CSR) was tied to the same ACME account that completed the original validation (notably for DNS-01 challenges), enabling potential “hijack” re-issuance scenarios (including wildcard certificates) without fresh validation. Additional observations included client-IP attribution problems behind a reverse proxy (requests appearing to originate from an internal address), which contributed to anomalous behavior and helped surface the underlying validation/authorization weakness; the net risk was unauthorized certificate issuance that could support man-in-the-middle attacks if abused.