IIRC The pin must contain at least one key that's in the current chain and at least one key that's not in the current chain. Then the malware could call out to

IIRC The pin must contain at least one key that's in the current chain and at least one key that's not in the current chain. Then the malware could call out to let's encrypt to issue a certificate, then load the certificate into nginx/apache/whatever, then remove the let's encrypt private key from the file system. That allows the webserver to continue serving traffic with LE's key + ransomware key until it's restarted. 1.) Infect webserver 2.) Generate public/private key pair for the purposes of the ransom on the CC server, then send back the public key back to the compromised server. 3.) Use webserver to issue LE SSL certificate. Delete the private key once it's loaded into the webserver process. 4.) Serve traffic with the hashes of the LE key and the ransomware key. If the sysadmin restarts the webserver process, they are screwed since that's the only process that contains the LE private key.