AbstractAs an important kind of digital signature, the aggregate signature could aggregate n signatures into a signature and verify those signatures simultaneously. It is suitable for the constrained environment with limited ability of computation and communication. Recently, Chen et al. proposed a certificateless aggregate signature scheme to improve the performance of the verification. This paper proposes two concrete attacks against the certificateless aggregate signature scheme of Chen et al. to show that their scheme is not secure for practical applications, that is, the adversary can forge a signature of any message easily. Copyright © 2016 John Wiley & Sons, Ltd.