I Factored a 90s Certificate Authority's Keys — Here's What I Learned About Web Security's Wild West

The actual blog post Every few years, the cryptographic community quietly deprecates a key size that was once considered secure. What was 128-bit encryption in the 90s feels dangerously inadequate today, and RSA keys that once seemed impossibly large now fall to factorization in hours on consumer hardware.

This is exactly what happened recently when a security researcher published results from factoring 512-bit RSA keys from ancient root certificate authorities (CAs) — the trusted anchors that browsers rely on to verify website identities. The keys in question came from Netscape 4.51, released in March 1999, which shipped with certificates from a Canadian CA called E-Certify. These roots were trusted for SSL connections until 2003, when the cryptographic community finally recognized that 512 bits was never sufficient.

Why 512 Bits Was Always a Bad Idea

RSA-512, as the name suggests, uses a 512-bit modulus — the product of two large prime numbers. In the 1990s, factoring such a number was theoretically possible but practically difficult. However, the math hasn't changed; our computing power has. A modern Ryzen 9 processor can factor a 512-bit RSA key in about 30 hours using open-source tools like CADO-NFS. In 1999, the same key would have required either a supercomputer or a massive distributed effort.

What's particularly striking is that even in 1999, this was cutting it close. RSA-155 (a 512-bit number with 155 decimal digits) was factored in August 1999, just months after the E-Certify certificates shipped. The researcher noted that these keys probably shouldn't have been issued in the first place.

The Historical Context of Web PKI

The Web PKI — the system of certificate authorities that secures HTTPS — was built on trust assumptions that seem quaint today. In the 1990s, browser vendors shipped with dozens of root certificates from authorities around the world, with minimal standardization on key sizes or operational practices.

Netscape, which essentially invented web commerce with SSL in 1994, was particularly permissive. IE was more conservative — no 512-bit RSA roots for SSL ever shipped with Internet Explorer. But Netscape's approach created a historical artifact: 512-bit CA certificates that remained trusted on any system running an old version of Netscape with a mis-set clock.

What This Means for Modern Security

The takeaway isn't just "never use 512-bit RSA." That's obvious. The more important lesson is that security standards are living documents. A 2048-bit RSA key, which current best practices require, will eventually be considered too small. The NIST Post-Quantum Cryptography standardization project is already underway because researchers anticipate that quantum computers will eventually break RSA entirely.

For developers and organizations today, this historical lesson reinforces a few key principles:

• Plan for algorithm migration: Your infrastructure will need updates as cryptographic standards evolve. Avoid hardcoding specific algorithms.
• Monitor deprecation timelines: Certificate authorities and browsers regularly announce sunset dates for older key sizes and hash functions.
• Automate certificate renewal: Manual processes lead to forgotten certificates and outdated configurations.
• Use certificate transparency: Modern CAs must log certificates publicly, making it harder for malicious actors to obtain fraudulent certificates.

The Fun Part

Beyond the security implications, there's something undeniably cool about cracking cryptographic keys from a defunct certificate authority. The researcher published both the E-Certify private keys and even set up a test HTTPS server that works with Netscape Navigator 4.51. It's a time capsule, proving that these old certificates can still authenticate connections — at least to browsers running software that's older than many of today's developers.

If you're curious about exploring old certificate archives yourself, the researcher has published tools and instructions for extracting and analyzing historical root certificates. You might find other forgotten CAs with similarly weak keys. It's a reminder that internet history leaves traces, and not all of them were secure to begin with.

The next time you configure TLS for your application, take a moment to appreciate how far we've come — and how automatically your hosting platform probably handles certificate renewals, key sizes, and cipher suite selection. The Wild West days of 512-bit CAs are behind us, but the lessons about cryptographic hygiene remain as relevant as ever.