Wildcard Hijack: TrustAsia Revokes 143 Certificates After LiteSSL Vulnerability

LiteSSL (operated by TrustAsia) had a critical ACME implementation flaw: the service misattributed client IPs to an internal reverse proxy and failed to enforce that a certificate signing request originated from the same ACME account that performed DNS-01 validation. This allowed researchers to re-issue wildcard certificates for domains validated by others, creating a real risk of Man-in-the-Middle attacks; TrustAsia revoked 143 affected certificates, patched the service, reset ACME authorizations, and restored issuance on 2026-01-21. Users with LiteSSL certificates issued after 2025-12-29 are advised to check certificate status.