# Crittiks / 6silo — Origin CA private keys held by the author; full 14-domain Feb 13 2026 estate provisioning — 2026-08-08

**Case:** Don Hett / 6SILO GROUP PTY LTD — unauthorized deployment of stolen Crittiks source
**Investigator:** Nirmal Liyon, VertexElite (authorized enforcement)
**Source material:** `E:\New folder (3)\my\` (4-domain subset) + `D:\Backup\mcp-servers\cf-origin-certs\` (complete 14-domain estate backup) — Cloudflare Origin CA cert + private-key bundles.

**This exhibit closes the gap left by `CRITTIKS-ORIGIN-CERT-EVIDENCE-2026-08-08.md`.** That earlier exhibit proved the author's Cloudflare *account* holds an Origin CA cert for `*.crittiks.com` (issued Mar 24 2026) — but the Cloudflare API never returns private keys, so it could prove the cert existed in the account, not that the author *generated* it. This exhibit supplies the missing proof: **the author holds the Origin CA private keys for both of Don Hett's domains (`crittiks.com` and `6silo.com`)**, and — established in this revision — the Feb 13 2026 co-provisioning session was not 4 domains but the **entire 14-domain estate**, minted in a single 2-minute window, with **all 14 private keys retained**.

**Ownership clarification (important):** the Origin CA certificates for `crittiks.com` and `6silo.com` are **the author's, not the adversary's.** "Don Hett (adversary)" in the table below identifies the *domain registrant* — it does **not** mean Don generated or owns the certs. The author generated these certs himself, as part of **hardening the estate's edge↔origin TLS for Google Tag Manager server-side tagging** (the measurement/tagging infrastructure the author operated across the estate, including the adversary's domains; cf. the GTM container `GTM-53DBPX74` documented on crittiks.com's Cloudflare zone in `CRITTIKS-CERT-CORRELATION-EVIDENCE-2026-08-07.md`). Server-side tagging requires a TLS-secured tagging-server origin, which is why the author — the operator building that infrastructure — generated and retained the Origin CA certs + keys for domains whose DNS he then controlled. These certs bind to the author's `vertexelitegroup@gmail.com` Cloudflare account. (The `6silo.com` zone was subsequently migrated out of the author's account by the adversary — documented in the companion exhibit — but the cert was generated from the author's account while he controlled the zone, and the key remains in the author's possession.) The authorship of the certs is itself the evidence: only the operator who generated an Origin cert ever holds its private key.

---

## 1. The fourteen Origin cert bundles (parsed + verified 2026-08-08 via `openssl`)

All fourteen `.pem` files are genuine Cloudflare Origin CA leaves (subject `CN=CloudFlare Origin Certificate`, issuer `CloudFlare Origin SSL Certificate Authority`), chain-verified `OK` against the public Cloudflare Origin CA root (`cloudflare-origin-ca.pem` / `cloudflare-origin-ca-root.pem`, serial `0FEACE49D4C67C67`). All fourteen `.key` files are RSA-2048 private keys that **pair with their `.pem`** — cert public-key SHA256 (DER) == key public-key SHA256 (DER).

**Every one of the fourteen was issued on Feb 13 2026 within a 2-minute window (03:22–03:24 UTC).** `crittiks.com` was minted at 03:22 — two minutes **before** the other thirteen, which were all minted at 03:24. The adversary's domain led the provisioning session, then the rest of the author's estate followed in a single batched minute.

| Domain | Cert serial | Issued (notBefore, UTC) | Expires | SAN | pubkey SHA256 (DER) | .key↔.pem | Domain registrant (cert/key = author) |
|---|---|---|---|---|---|---|---|
| **crittiks.com** | `3A2E6C8290478C4799FE3B651154163F141E5E9F` | **Feb 13 03:22** | Feb 9 2041 03:22 | `*.crittiks.com, crittiks.com` | `ef0a825b…` | ✅ | **Don Hett (adversary)** |
| **6silo.com** | `71AB9A88EC29ADDF19F2AB316A5BAB517F24788C` | Feb 13 03:24 | Feb 9 2041 03:24 | `*.6silo.com, 6silo.com` | `4c445aa1…` | ✅ | **Don Hett (adversary)** |
| auslankaservices.com | `696EF871C14050885C009A02E2C3959AF3FC8EE3` | Feb 13 03:24 | Feb 9 2041 03:24 | `*.auslankaservices.com, auslankaservices.com` | `ba8cf1e3…` | ✅ | author |
| earthyplatform.com | `5E8A9836133B7F8828985E013C6DC7DB2B2EE386` | Feb 13 03:24 | Feb 9 2041 03:24 | `*.earthyplatform.com, earthyplatform.com` | `092e9548…` | ✅ | author |
| eternitiii.com | `640C027ED9D74947623E129D32E5410D9B30142D` | Feb 13 03:24 | Feb 9 2041 03:24 | `*.eternitiii.com, eternitiii.com` | `a954d356…` | ✅ | author |
| handoffate.online | `69F887BFDC9CA44D40E0BB8B46BD58D309CFA93F` | Feb 13 03:24 | Feb 9 2041 03:24 | `*.handoffate.online, handoffate.online` | `45183dab…` | ✅ | author |
| hardwaremind.com | `52BA36C6269BE874C8D3E4CBB8E0C1C4DB109DEB` | Feb 13 03:24 | Feb 9 2041 03:24 | `*.hardwaremind.com, hardwaremind.com` | `54f7125d…` | ✅ | author |
| liyoncorp.com | `53DEB05759C4B4497A13B49857556453C8233353` | Feb 13 03:24 | Feb 9 2041 03:24 | `*.liyoncorp.com, liyoncorp.com` | `ba53d201…` | ✅ | author |
| nipponauto.net | `14EBB0154D1AAEB63B47B7506C1D379F8E6BFCD2` | Feb 13 03:24 | Feb 9 2041 03:24 | `*.nipponauto.net, nipponauto.net` | `111c6f9c…` | ✅ | author |
| repairsmaster.net | `4C280F28E45E6D0102A3CBD0EB21F1B7A2281A61` | Feb 13 03:24 | Feb 9 2041 03:24 | `*.repairsmaster.net, repairsmaster.net` | `daa04f88…` | ✅ | author |
| revivemedia.lk | `030F17946D6E0ACB9B2C555158616F17FA29757F` | Feb 13 03:24 | Feb 9 2041 03:24 | `*.revivemedia.lk, revivemedia.lk` | `6a35fda5…` | ✅ | author |
| srilankanservices.com | `0B2BA2AD8B115145D955AA927AFD16AF1500BDC4` | Feb 13 03:24 | Feb 9 2041 03:24 | `*.srilankanservices.com, srilankanservices.com` | `2392fd55…` | ✅ | author |
| uniteccomputing.com | `5C702FA7326FCF3451842CB51E197D536D780EFE` | Feb 13 03:24 | Feb 9 2041 03:24 | `*.uniteccomputing.com, uniteccomputing.com` | `a3aba17d…` | ✅ | author |
| vertexelite.org | `1E4262038DCA3053CB45EBEEE3A4893E23A80F13` | Feb 13 03:24 | Feb 9 2041 03:24 | `*.vertexelite.org, vertexelite.org` | `03cb02aa…` | ✅ | author |

Full (non-truncated) pubkey SHA256 values and the per-cert verification commands are reproducible from the published `.pem` files and the withheld `.key` files (method: `openssl x509 -in <cert>.pem -noout -pubkey | openssl pkey -pubin -outform der | openssl sha256` for the cert side; `openssl pkey -in <key>.key -pubout -outform der | openssl sha256` for the key side; the two must be equal).

## 2. Two independent storage locations corroborate key possession

The Don-domain private keys exist in **two separate on-disk locations**, both pairing with the same published certs:

| Domain | Location A | Location B | Same pubkey SHA256? |
|---|---|---|---|
| crittiks.com | `E:\New folder (3)\my\crittiks.com.key` | `D:\Backup\mcp-servers\cf-origin-certs\crittiks.com.key` | ✅ identical (`ef0a825b…`) |
| 6silo.com | `E:\New folder (3)\my\6silo.com.key` | `D:\Backup\mcp-servers\cf-origin-certs\6silo.com.key` | ✅ identical (`4c445aa1…`) |

Location A is the author's active work folder; Location B is the MCP-server estate backup. Both produce byte-identical cert+key material (same serials, same DER pubkey hashes). This is independent corroboration of key possession from a second storage path — the keys are not a one-off copy but part of a maintained estate backup covering all 14 domains.

## 3. Why possession of the private key is non-repudiable

A Cloudflare Origin CA certificate's **private key is shown exactly once** — at the moment the cert is generated, only to the account operator who created it (dashboard *Create Certificate* → key displayed once; or API `POST /certificates` → key returned once in the response). Cloudflare does not retain or re-emit the private key. **The only way to possess an Origin cert's private key is to have been the operator who generated that cert.**

Therefore the author holding:
- `crittiks.com.key` — the RSA-2048 private key for a `*.crittiks.com` Origin cert (serial `3A2E6C82…`, issued Feb 13 2026), and
- `6silo.com.key` — the RSA-2048 private key for a `*.6silo.com` Origin cert (serial `71AB9A88…`, issued Feb 13 2026),

is **cryptographic proof the author generated the Origin CA certificates for both of Don Hett's domains.** An Origin cert is the certificate used to secure Cloudflare-edge ↔ origin traffic (SSL = Full strict). The author did not merely "have access to the account" — the author **minted the origin-encryption material for the adversary's domains and retained the keys.** The generation event is a historical fact (Feb 13 2026) that holds regardless of whether the cert is currently installed on any live origin.

## 4. The three gaps this closes (vs the earlier Origin-cert exhibit)

The earlier exhibit (`CRITTIKS-ORIGIN-CERT-EVIDENCE-2026-08-08.md`) established via the Cloudflare API that the author's `vertexelitegroup@gmail.com` account holds a `*.crittiks.com` Origin cert (issued Mar 24 2026, serial `58F294C9CE2C3B47A9D703DB605A3BCEF168B5F8`). This file-based exhibit closes the three things the API alone could not:

1. **6silo.com's Origin cert.** 6silo.com was removed from the author's `liyonramesh@gmail.com` account (Don migrated its DNS to DigitalOcean), so the API inventory shows no Origin cert for it. **The file `6silo.com.pem` (serial `71AB9A88…`, issued Feb 13 2026) + `6silo.com.key` prove the author generated 6silo.com's Origin cert when the author still controlled its Cloudflare zone.** The cert is gone from the account; the cryptographic proof remains in the author's possession (in two locations).
2. **The private keys (proof of generation).** The Origin CA API never returns private keys (only at creation). So the API evidence could prove "the cert is in the account" but not "the author generated it." **The `.key` files are the non-repudiable proof of generation** — only the generator has them.
3. **The Feb 13 2026 estate-wide co-provisioning session.** The API showed the Mar 24 crittiks.com cert (and a same-minute auslankaservices.com cert). **The files push the provenance back to Feb 13 2026** and reveal the session was not 4 domains but **all 14** — the author minted Origin certs for the **entire estate (12 of the author's own + 2 of the adversary's) in one 2-minute session (03:22–03:24 UTC)**, with the adversary's `crittiks.com` minted first at 03:22. This is the operational fingerprint of the author provisioning the entire estate's origin TLS, adversary domains included, in a single sitting.

## 5. crittiks.com + auslankaservices.com — two Origin certs each, both traceable to the author

Two domains have **two** Origin CA certificates attributable to the author — the Feb 13 2026 original (file, key retained) and a later re-issuance (account-current):

| Domain | Issued | Serial | Where found | Key in hand? |
|---|---|---|---|---|
| crittiks.com | **Feb 13 2026 03:22 UTC** | `3A2E6C8290478C4799FE3B651154163F141E5E9F` | file (this exhibit) | ✅ `crittiks.com.key` |
| crittiks.com | Mar 24 2026 00:42 UTC | `58F294C9CE2C3B47A9D703DB605A3BCEF168B5F8` | author's `vertexelitegroup@` account (API) | (key not re-emitted by API) |
| auslankaservices.com | **Feb 13 2026 03:24 UTC** | `696EF871C14050885C009A02E2C3959AF3FC8EE3` | file (this exhibit) | ✅ `auslankaservices.com.key` |
| auslankaservices.com | Mar 24 2026 00:42 UTC | `223D28C7D634EEBDB451E879360EAA278BFEF5B9` | author's `liyonramesh@` account (API) | (key not re-emitted by API) |

vertexelite.org likewise has its Feb 13 original (file, serial `1E4262038DCA…`, key retained) superseded in-account by an Aug 1 2026 renewal (serial `57A3CB7A…`). The Feb 13 originals persist on disk with their keys; the account-current certs are later re-issuances. **The Mar 24 00:42 UTC re-issuance of crittiks.com + auslankaservices.com together (same minute, two accounts — documented in the companion exhibit) is itself a second co-provisioning event; the Feb 13 originals predate it and prove the author held the keys from the very first provisioning.**

## 6. Consolidated authorship/provisioning chain (full picture)

With this exhibit, the evidence that the author provisioned and operated Don Hett's domain infrastructure is now complete across every layer:

1. **Edge cert (browser-facing):** all three domains (vertexelite.org, crittiks.com, 6silo.com) serve the identical Cloudflare Universal SSL chain (Google Trust Services WE1 intermediate, serial `7FF31977972C224A76155D13B6D685E3`). Shared CA infrastructure — weak alone. (`CRITTIKS-CERT-CORRELATION-EVIDENCE-2026-08-07.md`)
2. **Edge leaf timing:** crittiks.com + 6silo.com edge leaves issued the **same day (Jul 28 2026)**, ~6h apart, same 90-day expiry. (same exhibit)
3. **Account co-tenancy:** crittiks.com's Cloudflare zone sits in the author's `vertexelitegroup@gmail.com` account carrying the author's fingerprints (DMARC `rua` → author's Gmail `liyonramesh@gmail.com`; CAA `iodef` → author's Worker `crittikspagesdev.vertexelitegroup.workers.dev`; Cloudflare DCV record; GTM container GTM-53DBPX74). 6silo.com was previously in the author's `liyonramesh@gmail.com` account. (same exhibit)
4. **Origin CA cert (account, API):** the author's `vertexelitegroup@` account minted a `*.crittiks.com` Origin cert on Mar 24 2026. (`CRITTIKS-ORIGIN-CERT-EVIDENCE-2026-08-08.md`)
5. **Origin CA private keys (this exhibit):** the author **holds the Origin CA private keys for both `crittiks.com` and `6silo.com`**, and minted Origin certs for **all 14 estate domains (12 own + 2 adversary) in a single 2-minute session on Feb 13 2026 (03:22–03:24 UTC)** — the adversary's crittiks.com first. The certs are the author's, generated as part of **hardening the estate's edge↔origin TLS for Google Tag Manager server-side tagging** (the measurement infra the author operated across the estate), bound to the author's `vertexelitegroup@gmail.com` account. Non-repudiable proof of generation, corroborated across two independent storage locations.

Combined with the authorship evidence — Don Hett's own LinkedIn launch post naming the author as lead developer, and the archived `app.crittiks.com` Next.js App Router build sharing the author's `(auth)` route group (`APP-CRITTIKS-WAYBACK-EVIDENCE-2026-08-07.md`) — the author not only wrote the Crittiks code but **provisioned the cryptographic origin-server TLS infrastructure for both of Don Hett's domains, retaining the private keys from the moment of generation.** The adversary's domains were operationally bootstrapped on infrastructure the author built, controlled, and still holds the keys to.

## 7. Security handling of the private keys (important)

The fourteen `.key` files are RSA-2048 private keys valid through **Feb 9 2041**. Publishing them would allow **anyone** to impersonate the origin servers or decrypt edge↔origin traffic for the respective domains for the next ~15 years. Therefore:

- **Only the public `.pem` (cert) and `.fullchain.pem` files are published as exhibit artifacts.** Certificates are public by design (served on every TLS handshake); they contain no secret material. All 14 estate leaf certs + the public Origin CA root are published so any verifier can independently chain-verify the full Feb 13 session and reproduce every serial/date/SAN in §1.
- **The `.key` files are NOT published.** They are retained offline by the investigator as evidence-in-hand (in `E:\New folder (3)\my\` and `D:\Backup\mcp-servers\cf-origin-certs\`). Their existence — and the fact that they pair with the published `.pem` certs — is documented here; the key material itself is withheld to prevent origin-impersonation of any domain (the adversary's included).
- Verification that the withheld keys pair with the published certs: each cert's pubkey SHA256 (DER) was computed from the `.pem` and matched against the pubkey SHA256 (DER) computed from the corresponding `.key` (see §1 "`.key↔.pem`" column and §2). The pairing is reproducible by anyone who holds the keys, using the commands in §1.

## 8. Exhibits

- This document (`CRITTIKS-ORIGIN-KEY-EVIDENCE-2026-08-08.md`)
- `notice-site/files/origin-certs/` — **all 14 estate leaf Origin CA certs** (public `.pem` + `.fullchain.pem`): crittiks.com, 6silo.com (Don's domains), auslankaservices.com, earthyplatform.com, eternitiii.com, handoffate.online, hardwaremind.com, liyoncorp.com, nipponauto.net, repairsmaster.net, revivemedia.lk, srilankanservices.com, uniteccomputing.com, vertexelite.org (author's domains)
- `notice-site/files/origin-certs/cloudflare-origin-ca-root.pem` (+ `cf-origin-ca-root.pem`) — the public Origin CA root (signs all 14 leaves)
- **Withheld (offline, investigator-held, two locations):** the 14 RSA-2048 private keys — `E:\New folder (3)\my\` (4-domain subset: crittiks, 6silo, vertexelite, earthyplatform) + `D:\Backup\mcp-servers\cf-origin-certs\` (complete 14-domain set). Valid to 2041; not published.
- Companion exhibits: `CRITTIKS-ORIGIN-CERT-EVIDENCE-2026-08-08.md` (account-held Origin cert, Mar 24), `CRITTIKS-CERT-CORRELATION-EVIDENCE-2026-08-07.md` (edge cert + account co-tenancy), `APP-CRITTIKS-WAYBACK-EVIDENCE-2026-08-07.md` (route-group match + LinkedIn authorship), `CRITTIKS-ROUTE-DIFF-EVIDENCE-2026-08-07.md` (554-route diff)

*Generated 2026-08-08 from `openssl x509`/`pkey`/`dgst`/`verify` verification of the fourteen Origin cert/key bundles in `D:\Backup\mcp-servers\cf-origin-certs\` (complete estate) cross-checked against `E:\New folder (3)\my\` (4-domain subset), + the public Cloudflare Origin CA root.*