Loading story…
GlobalSign said it will stop issuing Extended Validation (EV) TLS/SSL certificates and will revoke a subset of existing SSL certificates that failed to meet CA/Browser Forum validation requirements. The company said the affected revocations stem from shortcomings in its own validation process rather than customer actions, particularly around verifying organizations against official registration records using qualified independent information sources, and warned customers to replace impacted certificates to avoid service disruption.
The move reflects broader changes in browser behavior and industry standards that have reduced the practical value of EV certificates while tightening compliance expectations for certificate authorities. GlobalSign said existing EV certificates not affected by the compliance issue will remain valid until expiration, and it is directing customers toward other certificate options for website and IT infrastructure protection as CA/Browser Forum rule changes continue to reshape organizational validation practices.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
GlobalSign said it will stop issuing Extended Validation TLS/SSL certificates, citing evolving industry practices and CA/Browser Forum requirements. The company said the change takes effect on June 13 at 04:10 MSK, while existing EV certificates will remain valid until they expire.
GlobalSign announced that some SSL certificates would be revoked because its validation process did not comply with CA/Browser Forum requirements. The company said affected certificates were to be revoked on the 13th at 04:10 MSK and urged customers to replace them to avoid disruption.
The references state that CA/Browser Forum requirements for EV validation were revised in 2022, with later updates in 2024 and 2026 affecting how certificate authorities verify organization information and EV fields.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
cabforum.org
Open sourceopennet.me
Open sourceopennet.ru
Open sourcecabforum.org
Open sourcecabforum.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
DigiCert disclosed a breach in which a threat actor socially engineered its support team with a malicious ZIP file disguised as a customer screenshot, compromising two analyst workstations and gaining access to initialization codes for previously approved but undelivered EV code-signing certificate orders. The attacker used that access to obtain legitimate trusted code-signing certificates, and DigiCert revoked 60 certificates in response, including 27 directly linked to the intrusion. Reporting indicates 11 of those certificates were already used in the wild to sign **Zhong Stealer** malware, while a misconfigured CrowdStrike EDR agent on one compromised machine helped the attacker remain undetected for nearly two weeks. The incident unfolded alongside a separate trust-related disruption affecting DigiCert certificates on Windows systems: a faulty Microsoft Defender signature update released around April 30 falsely detected the legitimate **DigiCert Assured ID Root CA** and **DigiCert Trusted Root G4** certificates as `Trojan:Win32/Cerdigent.A!dha`. On affected hosts, Defender quarantined registry entries from the Windows trust store, raising the risk of SSL/TLS validation failures, broken code-signing verification, browser warnings, and enterprise application outages. Microsoft acknowledged the false positives and issued corrected definitions, with version `.430` cited as restoring the removed certificates automatically, while DigiCert tightened controls by enforcing MFA on administrative workflows, restricting access to initialization codes, limiting attachment types in support channels, and improving logging.
Jul 20, 2026
DigiNotar, a Dutch certificate authority, was compromised and used to issue at least 531 fraudulent SSL certificates for 344 domains, including `google.com`, enabling spoofing and man-in-the-middle attacks against supposedly secure services. Reporting indicated the fake Google certificate was likely used to intercept Gmail traffic from users in Iran, potentially exposing roughly 300,000 accounts and putting dissidents at risk. The breach was publicly linked to the actor who had claimed responsibility for the earlier Comodo certificate fraud, and it intensified criticism of the certificate authority trust model as incapable of resisting nation-state abuse. The fallout spread quickly across browsers, operating systems, and government services. Google, Microsoft, and Mozilla moved to distrust DigiNotar certificates, while Microsoft issued advisory `2607712` and updates including `KB2607712` and `KB2616676` to place DigiNotar certificates in the Windows Untrusted Certificate Store; Safari users were reported to remain exposed for a time. In the Netherlands, the government took over DigiNotar’s operations after investigators found severe security failures, warned that it could not guarantee the safety of its own websites, and shifted trust for public-sector certificates as DigiNotar’s business collapsed into bankruptcy.
Jun 29, 2026
TrustAsia revoked **143 SSL/TLS certificates** after identifying a vulnerability in its *LiteSSL* ACME issuance service that enabled **improper reuse of domain validation artifacts** across different ACME accounts. The issue, tracked in **Mozilla Bugzilla `#2011713`**, led TrustAsia to **suspend ACME issuance**, investigate scope, and perform a mass revocation of impacted certificates issued via ACME after **2025-12-29**; TrustAsia reports the service has been **patched and restored**. Technical reporting indicates the root cause was a **logic/authorization handling failure** in LiteSSL’s ACME implementation: the system did not reliably ensure that a certificate request (CSR) was tied to the **same ACME account** that completed the original validation (notably for **DNS-01** challenges), enabling potential “**hijack**” re-issuance scenarios (including wildcard certificates) without fresh validation. Additional observations included client-IP attribution problems behind a reverse proxy (requests appearing to originate from an internal address), which contributed to anomalous behavior and helped surface the underlying validation/authorization weakness; the net risk was unauthorized certificate issuance that could support **man-in-the-middle** attacks if abused.
Jun 29, 2026