In a few days, my team from @gitguardian_official@infosec.exchange and I will be in Taipei for RWC. We'll present the results of a joint research with Google researcher where we mapped leaked private keys to actual web certificate using Certificate Transparency data.
Today, we released a companion blog post that summarizes this research: https://blog.gitguardian.com/certificates-exposed-a-google-gitguardian-study/.
Bottom line: from the 1M private keys we had in our dataset, we found 40k were associated with 140k CT-logged certificates. Of those, 2,600 were valid at the time. We estimate that around 4,000 certificates are compromised every year because of a leaked key.
Among all compromised certificates's owners, we found 19 governmental entities from various countries, multiple Fortune 500, and 🥁 one certificate authority.
In my completely unbiased opinion, that's very insightful research 🙂.