Bdtyktl

Are there any known cases of HTTPS websites leaking the private key of their SSL certificate? Is it even technically possible for a bad website admin to misconfigure a site to send the private key as part of the certificate chain?

Are there any known cases of HTTPS websites leaking the private key of their SSL certificate?

Yes - the Heartbleed bug involved memory leaks out of the HTTP server such that:

We attacked ourselves from outside, without leaving a trace. Without
using any privileged information or credentials we were able steal
from ourselves the secret keys used for our X.509 certificates, ...

Aside from bugs like that,

Is it even technically possible for a bad website admin to
misconfigure a site to send the private key as part of the certificate
chain?

Sure. If you specify the wrong file in, for example, SSLCertificateChainFile then Boom! There goes the private key.

Doing so is not recommended.

Are there any known cases of HTTPS websites leaking the private key of their SSL certificate?

Strictly speaking, a private key should have permissions dr--------, with root:root. So, only the root user can read the certificate. If this is misconfigured and the web server has access to the private key, then in some circumstances such as the web server is compromised. Then here we could see the private key being 'leaked', unwittingly by the web server. This, of course, applies to any program which has read access to the private key though.

Is it even technically possible for a bad website admin to misconfigure a site to send the private key as part of the certificate chain?

By the configuration, I did with Apache 2, no! So, one of my web server configurations involves:

    SSLCertificateFile /etc/apache2/ssl/safesploit.com.cert.pem

    SSLCertificateKeyFile /etc/apache2/ssl/safesploit.com.key.pem

    SSLCertificateChainFile /etc/apache2/ssl/fullchain.pem

So, while I understand your concern regarding a 'bad admin' placing the private key within the fullchain, it simply is not possible within Apache 2 vanilla, unless Apache was modified to accept this type of configuration.

For context:

• Public keys -r--r--r-- root root


• Private keys -r-------- root root

Yes, via either misconfiguration or as-yet unknown misconfigurations. I won't repeat the content of @gowenfawr 's answer, but TLS 1.3 intends to mitigate this via removing support for ciphers and potentially insecure configurations (https://blog.cloudflare.com/rfc-8446-aka-tls-1-3/).

There is also the SSL v2 vulnerability known as DROWN (https://drownattack.com/) where previously SSL v2 was known to be insecure but many installations left it enabled for compatibility reasons.

While not ideal, this led to the possibility of extracting the key from a server that used the same keys or certificate but happened to be running SSL v2, even (potentially) exposing the contents of TLS 1.2 services using the same certificate.

DROWN shows that merely supporting SSLv2 is a threat to modern servers and clients. It allows an attacker to decrypt modern TLS connections between up-to-date clients and servers by sending probes to a server that supports SSLv2 and uses the same private key.

edit;
I realised I didn't answer your question. Yes you can serve up your private key on a misconfigured web server, or as part of the chain