Hello, I was reading about this incident of alleged lawful intercept used on Hetzner and Linode in Germany in order to successfully MitM TLS-encrypted traffic for a period of months: https://notes.valdikss.org.ru/jabber.ru-mitm/ The link at the bottom on some ideas to detect and mitigate is also worth a read: https://www.devever.net/~hl/xmpp-incident I am still left wondering why the attacker did not use a block device and/or memory snapshot of the Linode VM in order to extract the real TLS key material and avoid having to issue new ones, which appeared in CT logs. At the moment my best guess is that perhaps the filesystem was protected by LUKS and the skills to extract key material from a memory dump, while existing, were in short supply. Meanwhile, the procedure to MitM network traffic through their own hardware on Hetzner and Linode is probably very well documented and tested, so maybe could be done straight away, and it was perhaps considered expedient to just risk the new certs being noticed. DNSSEC+CAA start to seem like very good ideas. Thanks, Andy -- https://bitfolk.com/ -- No-nonsense VPS hosting