Loading story…
D-Trust, the Bundesdruckerei-operated certificate authority, revoked the X.509/TLS certificate for ausweisapp.bund.de on September 25. Browsers will no longer trust the revoked certificate, potentially presenting certificate-security warnings to users accessing the German electronic-ID application’s domain; two other TLS certificates for the domain reportedly remain valid.
The certificate revocation list cites “Privilege Withdrawn” as the reason. That status does not alone indicate private-key compromise: it can reflect unauthorized or improper certificate use, changes to certificate-holder information, or a certificate issued in error. The precise cause had not been publicly disclosed, and Bundesdruckerei had not responded to media inquiries.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
The issuing certificate authority revoked the X.509/TLS certificate for ausweisapp.bund.de (serial number 7D0D9F5C1471C81F53BFFF2626EF925918217A35) at 13:55:06 GMT. The revocation list recorded the reason as “Privilege Withdrawn”; the specific cause was not publicly known.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
DigiNotar, a Dutch certificate authority, was compromised and used to issue at least 531 fraudulent SSL certificates for 344 domains, including `google.com`, enabling spoofing and man-in-the-middle attacks against supposedly secure services. Reporting indicated the fake Google certificate was likely used to intercept Gmail traffic from users in Iran, potentially exposing roughly 300,000 accounts and putting dissidents at risk. The breach was publicly linked to the actor who had claimed responsibility for the earlier Comodo certificate fraud, and it intensified criticism of the certificate authority trust model as incapable of resisting nation-state abuse. The fallout spread quickly across browsers, operating systems, and government services. Google, Microsoft, and Mozilla moved to distrust DigiNotar certificates, while Microsoft issued advisory `2607712` and updates including `KB2607712` and `KB2616676` to place DigiNotar certificates in the Windows Untrusted Certificate Store; Safari users were reported to remain exposed for a time. In the Netherlands, the government took over DigiNotar’s operations after investigators found severe security failures, warned that it could not guarantee the safety of its own websites, and shifted trust for public-sector certificates as DigiNotar’s business collapsed into bankruptcy.
Jun 29, 2026
TrustAsia revoked **143 SSL/TLS certificates** after identifying a vulnerability in its *LiteSSL* ACME issuance service that enabled **improper reuse of domain validation artifacts** across different ACME accounts. The issue, tracked in **Mozilla Bugzilla `#2011713`**, led TrustAsia to **suspend ACME issuance**, investigate scope, and perform a mass revocation of impacted certificates issued via ACME after **2025-12-29**; TrustAsia reports the service has been **patched and restored**. Technical reporting indicates the root cause was a **logic/authorization handling failure** in LiteSSL’s ACME implementation: the system did not reliably ensure that a certificate request (CSR) was tied to the **same ACME account** that completed the original validation (notably for **DNS-01** challenges), enabling potential “**hijack**” re-issuance scenarios (including wildcard certificates) without fresh validation. Additional observations included client-IP attribution problems behind a reverse proxy (requests appearing to originate from an internal address), which contributed to anomalous behavior and helped surface the underlying validation/authorization weakness; the net risk was unauthorized certificate issuance that could support **man-in-the-middle** attacks if abused.
Jun 29, 2026
GlobalSign said it will stop issuing Extended Validation (EV) TLS/SSL certificates and will revoke a subset of existing SSL certificates that failed to meet CA/Browser Forum validation requirements. The company said the affected revocations stem from shortcomings in its own validation process rather than customer actions, particularly around verifying organizations against official registration records using qualified independent information sources, and warned customers to replace impacted certificates to avoid service disruption. The move reflects broader changes in browser behavior and industry standards that have reduced the practical value of EV certificates while tightening compliance expectations for certificate authorities. GlobalSign said existing EV certificates not affected by the compliance issue will remain valid until expiration, and it is directing customers toward other certificate options for website and IT infrastructure protection as CA/Browser Forum rule changes continue to reshape organizational validation practices.
Jul 12, 2026