Encrypted traffic interception on Hetzner and Linode

ValdikSS documented a man-in-the-middle attack on jabber.ru and xmpp.ru, the largest Russian XMPP service, hosted at Hetzner and Linode in Germany. The attacker managed to issue multiple SSL/TLS certificates via Let’s Encrypt for both domains since 18 Apr 2023. Interception is confirmed from 21 July to 19 Oct 2023 and hit every connection to STARTTLS port 5222 (not 5223). It surfaced because the attacker failed to reissue a certificate, so the proxy served an expired one for jabber.ru (Hetzner). The attack stopped shortly after the investigation and support tickets began on 18 Oct 2023, but passive wiretapping (an additional routing hop) remains on at least one Linode server. Both networks appear to be reconfigured specifically for the XMPP service IP addresses, which points to lawful interception rather than a breach. A follow-up on mitigations recommends ACME-CAA to restrict issuance to your own CA account, Certificate Transparency monitoring, and end-to-end encryption with verified fingerprints for users. The Record asked Hetzner, Linode and Germany’s domestic intelligence agency for comment, and none had responded by publication. Pro tip for wiretappers: certificates expire.