By adopting advanced Internet of Things (IoT) technology to sense and collect traffic-related information to improve traffic safety and efficiency, the vehicular ad hoc network (VANET) is becoming a prominent application that changes human driving experiences in the current era. Because frequent data exchange occurs in open environments, VANETs are inherently vulnerable to security and privacy attacks. In history, many certificateless aggregate signature (CLAS) schemes with conditional privacy-preserving (CPP) have been proposed to ensure the authenticity and integrity of the exchanged data and protect users’ privacy. However, we reveal that the state-of-the-art schemes cannot be deployed in practical VANET applications by proposing concrete signature forgery attacks. To this end, we propose a new CLAS-based authentication scheme with CPP for VANETs. The rigorous security proofs based on the standard cryptographic assumption show that the scheme has enhanced security. Moreover, theoretical analysis and experimental evaluation illustrate the practicality of our design.