Andrew Ayer

@[email protected]

Bootstrapped founder of SSLMate (https://sslmate.com) and DNS Helper (https://www.dnshelper.com). Making SSL certificates and DNS records easier. #WebPKI and #CertificateTransparency research on the side.

Last Notes

2026-01-14 22:43:15 GMT

The State of OpenSSL for pyca/cryptography: https://cryptography.io/en/latest/statements/state-of-openssl/
Spoiler: it's bad.

2025-09-04 19:14:27 GMT

- reply

@nprofile…8nxg These are excellent discoveries! Do you want to post this to the mozilla-dev-security-policy thread (https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/SgwC1QsEpvc). Or I can relay them, with or without attribution.

2025-09-04 00:13:50 GMT

- reply

The first rogue 1.1.1.1 certificate was issued by Fina and logged to Certificate Transparency over a year ago.
AFAICT, the first person to notice any of this was Hacker News user JXzVB0iA, two days ago: https://news.ycombinator.com/item?id=45089708
This morning, it was reported to the certificate-transparency mailing list, with attribution to JXzVB0iA.
A few hours later, it was reported to the mozilla-dev-security-policy mailing list, without attribution.
Then Dan Goodin wrote his article, citing the mozilla-dev-security-policy post.
Very surprising that Cloudflare did not notice given they operate a CT monitor.

2025-09-03 12:07:55 GMT

Hey look, another certificate authority trusted ONLY by Microsoft is issuing certificates without validation (1.1.1.1/Cloudflare DNS in this case): https://crt.sh/?sha256=D42B028468E73795365102058CBCD350AD0A0B9CA7073C5362A570C5EC208A92
(h/t Hacker News user JXzVB0iA)

2025-06-21 22:20:52 GMT

- reply

Folks at Google have taken time on a Saturday to roll out a creative hack to unbreak the apps using this library. The folks at Apple, Google, and Mozilla who work on WebPKI and CT policy are truly some of the Internet's unsung heroes, for this and many other reasons.
https://follow.agwa.name/media/ec/8a/00/ec8a0007c9053df10a1f8f20676f3045ce02fe6598b42aaf8ffa9dee857b6902.png

2025-06-21 17:51:32 GMT

- reply

The Appmattus CT library doesn't even need to exist anymore - as of Android 16, you can opt your app into Certificate Transparency enforcement provided by the OS: https://developer.android.com/privacy-and-security/security-config#certificateTransparencySummary

2025-06-21 17:42:41 GMT

DO NOT USE THE APPMATTUS CERTIFICATE TRANSPARENCY ANDROID LIBRARY.
Over two years ago the library's developers were warned about the need to monitor the ct-policy mailing list if they were going to consume the Chrome CT log lists.
Over six months ago, an upcoming change to the log lists was announced on ct-policy.
The Appmatus developers ignored this, so when the change was published today, Android apps using Appmatus stopped working. Affected app developers are now flooding CT mailing lists demanding the log list change be reverted. The right fix is to stop using Appmatus - they clearly do not have their users' best interests in mind.

2025-06-04 16:12:39 GMT

Yandex's covert web-to-app tracking (https://localmess.github.io/) relies on shipping the private key for a publicly-trusted SSL certificate for yandexmetrica[.]com to every user of their apps, which is very forbidden.
Anyone want to extract the private key from their Android app so we can get the cert revoked for key compromise?
https://crt.sh/?q=yandexmetrica.com

2025-01-07 17:28:18 GMT

Yesterday's Alpine Linux 3.21.1 release prematurely removed Entrust from the trust store, breaking TLS connections to servers using Entrust certs. They should have waited until Jan 2, 2026. Unfortunately, they vendor curl's mk-ca-bundle.pl and didn't update it after curl fixed this bug. https://gitlab.alpinelinux.org/alpine/ca-certificates/-/issues/6
Alpine is a popular base image for containers so this has the potential to be disruptive.
Background: https://sslmate.com/blog/post/entrust_distrust_more_disruptive_than_intended

2024-11-30 14:20:30 GMT

A Brazilian certificate authority trusted only by Microsoft has issued a presumably-unauthorized certificate for google.com: https://bugzilla.mozilla.org/show_bug.cgi?id=1934361
This can used to intercept traffic to Google from Edge and other Windows applications (except Chrome and Firefox). Hug-ops to Google folks.
Microsoft are well aware of the extensive history of problems with this CA - I emailed them my concerns in 2021, and further issues were raised during a public CCADB discussion in 2022 - but they clearly don't care. I hope this incident prompts some change; Windows users deserve better!

2024-07-31 18:23:17 GMT

Cert Spotter lets you know if any of your certificates will be revoked in the upcoming DigiCert mass revocation. They appear in your Cert Spotter dashboard with the original expiration replaced by the revocation date.
Handy, because if you log into your DigiCert account, they just give you a list of serial numbers and expect you to figure out what certs they correspond to.
https://follow.agwa.name/media/cdac27488266eb796cbee4eeb803f80e69aecfdce40352469be7255a1fda1fe1.png

2023-11-02 13:18:44 GMT

The EU is considering a very bad law called eIDAS that would:
- Force browsers to accept government certificate authorities
- Ban additional security checks on certificates (such as Certificate Transparency) unless the EU agrees to them
This would undo 10 years of improvements to encryption on the Web and create an environment very favorable to MitM attacks.
If you're an EU citizen, consider writing to the MEP responsible for the eIDAS file, Romana JERKOVIĆ (https://www.europarl.europa.eu/meps/en/112747/ROMANA_JERKOVIC/home), to voice your concern.
Learn more at https://last-chance-for-eidas.org/