A combination of sensor nodes with limited storage, low data processing speed, and limited computing resources is known as wireless sensor networks (WSNs). Internet of things applications widely use sensors due to their low cost. The WSN environment still faces challenges in addressing security and privacy. Recently, Kar et al. presented an aggregate signature scheme that uses a certificateless primitive and has low computational costs. The security of the proposed CL-ASS lies in the hardness of solving the computational Diffie–Hellman problem (CDHP). Kar et al. stated that the CL-ASS is safe in a random oracle model. However, we assert that the scheme lacks security against two distinct kinds of attacks. We mount Type \(\mathcal{I}\mathcal{I}\) attack and a coalition attack on the CL-ASS. We introduce improvements to the scheme, enhancing its efficiency, security, and conditional privacy-preserving capabilities by substituting dummy identities for the real identities of each sensor node.