Compromise TLS trust identity

Artifact Security Cloud Security

The attacker holds the private key of a certificate authority or
intermediate issuing CA that client trust stores accept, and mints
certificates for domains they do not control. A browser or OS then
accepts a man-in-the-middle session as the genuine site. The key comes
from a compromised CA network (DigiNotar), from bad key generation that
makes it recoverable (eMudhra's single-byte scalars), from a compromised
issuance account (Comodo's reseller RA), from a certificate issued as a
CA when it was meant for a server (TURKTRUST), from an intermediate
delegated to a network appliance that intercepted traffic (ANSSI, MCS
Holdings), or from a CA issuing without the domain owner's knowledge
(Symantec test certificates). Distinct from T0208 (Compromise
code-signing identity): there the trust decision is artifact signature
verification; here it is the browser and OS trust store for TLS
sessions.

Where this idea came from

Public incident / advisory

This catalogue, from the eMudhra single-byte CA keys (Scott Helme, October 2026) where six TLS intermediates were recoverable in under a second. The historical class is documented by root-program operators — Comodo RA-account issuance (2011), DigiNotar (2011), TURKTRUST misissued intermediate (2012), ANSSI appliance intermediate (2013), MCS Holdings on CNNIC (2015), Symantec unowned-domain issuance (2015-2017).

Compromise TLS trust identity

Where this idea came from

Mitigations

Detections

Observed in incidents (8)

References