CAcompromissen

CAcompromissen refers to the compromise of a certificate authority (CA) within a public key infrastructure. It denotes a security incident in which a CA’s private keys or issuance controls are breached, enabling an attacker to issue trusted digital certificates for any domain.

In PKI, trust is anchored in the CA. A compromise undermines this trust across browsers, operating systems, and devices, potentially allowing impersonation, data interception, and traffic redirection through fraudulent certificates.

Causes include theft or leakage of private keys, weak key protection, compromised development or deployment environments, insider threats, and supply-chain intrusions. Misissuance of certificates or failures in validation and revocation processes can also contribute to a CA compromise becoming effective.

The consequences can be severe: widespread distrust in the affected PKI, revocation and re-issuance costs, and the need to reroute traffic or re-issue certificates for many domains. Recovery typically requires incident response, key rotation, revocation of affected certificates, and, where possible, transparency measures such as certificate logs.

Notable incidents have demonstrated the risk, including the DigiNotar breach of 2011 and later corrective actions, as well as the broader consequences for the Symantec CA ecosystem in 2017–2018 as trust was downgraded by major browsers. Mitigation focuses on hardware security modules, strict issuance controls, certificate transparency, short-lived certificates, and robust revocation mechanisms. See also certificate authorities, public key infrastructure, and certificate transparency.