[The Register] 23000 HTTPS certificates to expire soon after leak

[Ook]

23,000 HTTPS certs will be axed in next 24 hours after private keys leak

Customers of HTTPS certificate reseller Trustico are reeling after being told their website security certs – as many as 23,000 – will be rendered useless within the next 24 hours.

This is allegedly due to a security blunder in which the private keys for said certificates ended up in an email sent by Trustico. Those keys are supposed to be secret, and only held by the cert owners, and certainly not to be disclosed in messages. In the wrong hands, they can be used by malicious websites to masquerade as legit operations.

[dakboy]

Trustico wanted to do a mass revocation, was told by DigiCert that they can’t do that without there being a documented breach, so the CEO emailed the private keys to DigiCert which by definition is a breach.

Because that’s the mature, professional response.

Then Trustico failed to notify DigiCert properly that there was a breach.

It’s a shitshow and it’s all Trustico’s fault from what I can tell.

[Force10]

Holy crap. Shit show doesn’t even begin to describe this.