---
id: "CMP-202610-taiwan-certificate-authority-twca-reports-unauthorized-acces"
kind: "campaign"
aliases: []
title: "Taiwan certificate authority TWCA reports unauthorized access to its certificate RA server"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "TWCA certificates", "fixed": [], "vendor": "TWCA (Taiwan-CA)", "affected": "unknown"}]
ecosystems: []
tags: ["campaign", "certificate-authority", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-29T13:06:38+00:00"
updated_at: "2026-10-29T13:06:38+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-29T13:06:38+00:00"}]
---

# Taiwan certificate authority TWCA reports unauthorized access to its certificate RA server

TWCA (Taiwan-CA), a publicly trusted certificate authority, self-reported to Mozilla on 2026-10-29 that its monitoring detected signs of unauthorized access to its Registration Authority (RA) server, the system that approves certificate requests. TWCA isolated the server and is still investigating. It says no certificate mis-issuance has been found so far and promises a full incident report. Who is behind it, how they got in, when it started and whether any certificates were requested: unknown. At risk: anyone who trusts TWCA roots (browsers, OS and language trust stores) and TWCA customers, if attackers got certificates issued for domains they do not own.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :TWCA certificates affected unknown fixed ?

## How to check

Search Certificate Transparency logs (crt.sh, Censys) for TWCA-issued certificates for your domains that you did not request. If you have CAA records, check whether they allow TWCA (twca.com.tw). If you are a TWCA customer, review recent certificate orders and issuances in your account. Specific IOCs or affected certificate serials: unknown.

## Fix

Add CAA records that allow only the CAs you use. Set up CT monitoring for your domains. TWCA customers: watch for TWCA notices and be ready to revoke and reissue certificates if the incident report shows mis-issuance. Watch Mozilla Bugzilla 2086949 for the full report and any trust-store action.

## Timeline

- 2026-10-29T13:06:38+00:00 analyst

## Documents

- [describes] TWCA reports unauthorized access to its certificate RA server https://news.ycombinator.com/item?id=50287867
- [describes] TWCA: Unauthorized access to an RA server (Mozilla Bugzilla 2086949) https://bugzilla.mozilla.org/show_bug.cgi?id=2086949

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_