I was just wondering what will happen if the private key of a CA is leaked? Won't it be then possible to make fake certificates for any other website?


4 Answers 4



What will happen if the private key of a CA is leaked?

Meet answer:

make fake certificates for any other website



Verisign and other trusted root authorities keep their keys heavily protected because their entire business relies on having a trustworthy certificate.

If a leak were to happen, it wouldn't be long before Microsoft, Mozilla and the other vendors who keep lists of trusted CAs would remove the compromised certificate from their lists of trusted certificates, however the risk would still be there.

  • 1
    eff.org/observatory I speak to this thread from it's future. About one month prior to this comment, Scheiner on security addressed this issue. They have unsurprisingly, not done the right thing.
    – chiggsy
    Nov 4, 2010 at 21:13

Actually, if you had a CA's private key, you could make real, but illegitimate, certificates. There would be nothing fake about them, except that they wouldn't be made by the CA.

Presumably those people who maintain lists of trusted CA certificates would remove the compromised key, and the CA would have to create a new key (trivial), make sure this one's more secure (definitely not trivial), and distribute new certificates. In the meantime, not everybody would get the new list without the old root cert but with the new root cert, and the certificate infrastructure would be even shakier than it is now.


If a private key for a CA was leaked they would likely revoke the key. This is assuming that you are talking about one of the keys that a CA uses. Normally a CA has a master key which signs several other keys which are used by trusted authorities that are authorized to sign CSR's for customers.

If a CA lost their root level private key used to sign then anyone using it could create a fake certificate and SSL would pretty much be useless until all browsers released an update with a new list of trusted CAs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.