Post #3230998

In a few days, my team from @gitguardian_official and I will be in Taipei for RWC. We'll present the results of a joint research with Google researcher where we mapped leaked private keys to actual web certificate using Certificate Transparency data. Today, we released a companion blog post that summarizes this research: https://blog.gitguardian.com/certificates-exposed-a-google-gitguardian-study/. Bottom line: from the 1M private keys we had in our dataset, we found 40k were associated with 140k CT-logged certificates. Of those, 2,600 were valid at the time. We estimate that around 4,000 certificates are compromised every year because of a leaked key. Among all compromised certificates's owners, we found 19 governmental entities from various countries, multiple Fortune 500, and 🥁 one certificate authority. In my completely unbiased opinion, that's very insightful research 🙂.