"There were no end entity certificates issued out of the affected CA’s."

This seems like a weird statement given that anyone can issue certificates out of the affected CAs.

chrismorgan 6 hours ago | parent | next [-]

Almost all browsers require certificates be recorded in Certificate Transparency logs <https://en.wikipedia.org/wiki/Certificate_Transparency#Manda...>. Since those logs are empty in this instance, you can state that no one used a forged certificate with a mainstream browser, which is the most obvious (and desirable) attack type.

▲

happosai 2 hours ago | parent | next [-]

Mainstream browsers were a juicy but also a very short term attack target.

The more interesting targets will be various REST etc apis being called over https. Lots of people doing API clients have been ignoring the "what if someone tricks me to connect to an evil server" vector, because they assume TLS verification will protect them.

▲

chaz6 2 hours ago | parent | prev [-]

Can anyone sign certificates with the compromised keys and submit them to a CT log?

	▲	what an hour ago \| parent [-]
		Yes.

▲

trollbridge 7 hours ago | parent | prev | next [-]

Well, none came out of the Certificate Authority.

They just didn't mention that now anyone can be their own Certificate Authority.

	▲	sidewndr46 6 hours ago \| parent [-]
		So I guess October 2026 will be forever remembered as CA freedom day? can we all retire certbot now and just issue out our own certs

▲

2 hours ago | parent | prev | next [-]

[deleted]

▲

advisedwang 6 hours ago | parent | prev [-]

You can also monitor if they show up in certificate transparency logs. Which won't catch all fraudulently issued certs, but might show up some, especially if it's being widely abused.