"There were no end entity certificates issued out of the affected CA’s."
This seems like a weird statement given that anyone can issue certificates out of the affected CAs.
Almost all browsers require certificates be recorded in Certificate Transparency logs <https://en.wikipedia.org/wiki/Certificate_Transparency#Manda...>. Since those logs are empty in this instance, you can state that no one used a forged certificate with a mainstream browser, which is the most obvious (and desirable) attack type.
loading story #50199727
loading story #50199701
Well, none came out of the Certificate Authority.
They just didn't mention that now anyone can be their own Certificate Authority.
loading story #50196305
loading story #50207235
You can also monitor if they show up in certificate transparency logs. Which won't catch all fraudulently issued certs, but might show up some, especially if it's being widely abused.
{"deleted":true,"id":50199687,"parent":50195818,"time":1792696100,"type":"comment"}