TrustAsia Revokes 143 SSL/TLS Certificates After ACME Validation Flaw TrustAsia revoked 143 SSL/TLS certificates on January 21, 2026, following the discovery of a vulnerability in its LiteSSL ACME service. The flaw, reported via Mozilla Bugzilla (#2011713), allowed improper reuse of domain validation data across different ACME accounts, violating CA/Browser Forum Baseline Requirements (TLS BR 2.2.2, Section 3.2.2.4). The issue stemmed from a logic error in handling Authorization objects, where validation data was incorrectly shared between accounts. While initial speculation suggested External Account Binding (EAB) mismanagement, TrustAsia confirmed a strict one-to-one mapping between ACME accounts and EABs. The vulnerability affected certificates issued after December 29, 2025. TrustAsia’s response timeline (UTC+8) included: - 14:55: Report received via V2EX; issuance suspended. - 15:33: Initial revocation of two reported certificates. - 21:21: Full scope identified (143 certificates); batch revocation initiated. - 21:41: Patch deployed; all ACME authorizations reset to REVOKED. - 23:00: Service fully restored. All affected certificates were revoked, and TrustAsia plans to release a detailed incident report on Mozilla Bugzilla. The incident underscores the critical need for strict domain validation compliance in automated certificate issuance.