Your inspection root's private key may have left with a departing engineer: what can they now do, and what does replacing that root cost?

## What the holder can do With the private key, and without any access to your estate, they can present a chain that any managed device accepts for any hostname their constraints permit. The device does not care where the traffic is intercepted. For a company whose staff work from home networks, shared offices and public wireless, the attacker's positioning problem is close to trivial and is entirely outside your control. They also enjoy the same invisibility your proxy does: chains ending in a locally installed root are exempted from Certificate Transparency enforcement, so nothing they mint appears in a public log, and no domain owner will call you. ## Why revocation is the wrong lever The instinct is to revoke the root. It does nothing. A trust anchor is trusted because it is **present in the store**, and a validator does not go looking for revocation information about its own anchors; revocation checking applies to certificates *below* the anchor in a chain. Publishing a revocation list for your own root is theatre. Nor does revoking the certificates the proxy already issued help, since the thief signs fresh ones. The only revocation that exists for a private root is deletion from the trust store. That single fact reshapes the whole incident: **the exposure window is defined by how fast you can remove trust from devices, not by how fast you can generate a new key.** Generating a new root takes an afternoon. Removing an old one from an estate takes as long as the least reachable device. ## The order of operations Get the order wrong and you convert a security incident into an outage: 1. **Generate** the replacement root inside hardware, non-exportable, carrying the same name constraints, with a witnessed record. 2. **Distribute** it to every trust store *alongside* the old one. Both are now trusted. Nothing has broken and nothing is safer yet. 3. **Verify coverage**, device by device, against your inventory. This is the step that takes days and the step people skip. 4. **Cut the proxy over** to signing with the new key. Inspected sessions now chain to the new root, which every verified device already trusts. 5. **Remove the old root** from every store. This is the moment the thief loses the capability, and only this moment. Removing before distributing breaks every inspected session in the company. Cutting over before distribution completes breaks every device that has not yet received the new root. Both mistakes look identical to the help desk: everything is a certificate error. ## Which devices define the window The operating system trust store is the store you can reach with device management. The ones that lengthen the window are the ones nobody owns: - browsers and applications that ship and use their own bundled certificate list - language runtimes with a bundled certificate file that ignores the system store - container images baked with the old root and rebuilt on their own schedule - servers, appliances and lab devices where somebody once pasted the root in by hand - contractor and personally owned devices you enrolled but do not own - laptops that are switched off, on leave, or belonging to somebody on sabbatical Every one of those either keeps trusting the stolen root or stops working when you cut over. The honest plan names them before the incident, because discovering them during one is how a rotation turns into a week of outages. ## What you cannot establish afterwards You generally cannot prove whether the key was used. There is no external record to consult, so evidence comes from your own side: the proxy's issuance log compared against what your policy would have issued, and any observation of chains from your root that your proxy did not sign, which you can only see on paths you happen to watch. Treat inability to prove misuse as a reason to rotate, not a reason to wait. What you do about credentials that could have transited an intercepted session is an incident-response call and belongs to the responders, not to the CA custodian. ## The cost line A rotation is a fleet-wide push, a help-desk surge, a change window, an inventory reconciliation, and rediscovery of every hand-configured trust store in the company. That cost is exactly why the controls that make theft unlikely and detectable, hardware custody and dual control, are cheaper than they look, and it is the argument to make to whoever holds the budget.