> Also, the US Government was recently found to have fake Kaspersky SSL certs. This is not true. An old commit for a leaked implant included example client cer

> Also, the US Government was recently found to have fake Kaspersky SSL certs. This is not true. An old commit for a leaked implant included example client certificates, which were invalid and self-signed, used to disguise C2 communications as anti-virus updates to avoid scrutiny. Part of the system involved copying fields from valid certificates into self-signed (invalid ones) so the traffic would not look suspicious. If they actually had fake/spoofed SSL certificates valid for Kaspersky’s domain, that would be entirely different.