TrustAsia Pulls 143 Certificates Following Critical LiteSSL ACME Vulnerability

TrustAsia discovered a critical logic flaw in its LiteSSL ACME implementation that allowed domain validation data to be reused across ACME accounts, enabling unauthorized issuance of certificates (including wildcard certs). The company suspended ACME issuance, applied code fixes, revoked 140 still-valid certificates (143 impacted in total), reset all ACME authorizations to REVOKED, and restored service within about eight hours; a full incident report and root-cause details are forthcoming.