The sample certificate shows the hidden protest string embedded in the public key's modulus.
PROTEST CERTIFICATES EXPLOIT VANITY RSA KEYS TO SKIP ACME
*SSL/TLS demands a costly ACME dance and frequent renewals. The author shows how a vanity RSA key can embed a protest message and still obtain a signed certificate, exposing a structural weakness.*
The SSL/TLS ecosystem forces every public site into an ACME choreography: generate a key, prove DNS control, wait for a certificate that expires every few months, and repeat. The author finds this process needlessly complex and points out that certificates are issued over plaintext connections, with some authorities even using a "very secure" key like "4". Frustrated, he proposes a protest certificate that sidesteps the full PKI while still encrypting traffic. By controlling the public key, he crafts a vanity private key—313333333337, an "eleet" prime—and embeds a clear protest message directly into the modulus. The result is a functional certificate that carries a statement about the system's lax oversight.
Can a vanity RSA key bypass standard certificate issuance?
RSA keys consist of a modulus n (product of two large primes p and q) and a public exponent e. The industry standard exponent is 65537 because its few set bits speed encryption. The author notes that the CA used will refuse to sign keys with a non‑standard exponent, forcing e to remain 65537. However, the modulus is a user‑controlled 2,048‑ or 4,096‑bit value, offering space to hide data. By crafting a vanity private key—specifically the prime 313333333337—the author creates a weak public key that still passes CA checks because the CA only validates the exponent and the signature, not the strength of the modulus. This loophole lets a protest certificate be issued without the usual ACME workflow.
How does the author embed a message in the modulus?
The process starts with two random primes, p and q, whose product yields n. The author then alters the byte sequence of n to embed a chosen message in the base64 representation. Because the altered n no longer equals p × q, q is recomputed as n / p, rounded, and the next prime is selected. Changing q by only a few hundred affects the lower half of the product, leaving the upper half—where the message resides—intact. The author demonstrates this with an example: 58174124 × 918491824 = 53432457262362176, then incrementing q until the next prime yields a new product that still carries the embedded text. As long as the message sits in the upper half of n, it survives the adjustment.
What does the sample certificate reveal?
The posted certificate, valid from 2026‑11‑09 to 2027‑02‑07, contains the string "////You+dont+actually+pick+random+privat e+keys//No+one+checks+these+things//A+certificate+authority+got+away+with+the+number+4+for+a+year/////" embedded in the base64 payload. The author highlights that trusted CAs issue certificates over plaintext connections and even use a "very secure" key like "4". The certificate also shows the standard fields—issuer, subject, and extensions—while the hidden message proves that the public key can be manipulated without detection. This concrete example validates the protest approach and underscores the lack of scrutiny on key material.
What are the practical implications for web security?
Passive eavesdropping remains a real risk, and the author admits a desire to encrypt traffic without the full certificate apparatus. Protest certificates demonstrate that a functional TLS handshake can be achieved with a deliberately weak or message‑laden key, provided a CA signs it. While the method does not eliminate the need for a CA, it reveals that CAs do not verify the integrity of the modulus beyond basic checks. This opens a vector for malicious actors to embed covert data or weaken encryption while appearing legitimate, challenging the assumption that a signed certificate guarantees strong cryptography.
Frequently asked questions
What is a protest certificate?
A protest certificate is a TLS certificate that uses a vanity RSA key to embed a message, demonstrating that CAs will sign keys without checking the strength or content of the modulus.
Why does the author use the prime 313333333337?
The author chooses 313333333337 because it is an "eleet" prime that creates a weak public key, making the protest obvious while still being signable by a CA.
Can standard CAs sign keys with non‑standard exponents?
No. The author notes that the CA used will refuse to sign keys with a non‑standard public exponent, forcing the exponent to remain the standard 65537.
The experiment lays bare a paradox: a signed TLS certificate can conceal a deliberately weak key and a protest message, yet still function in the browser. As CAs continue to rely on minimal checks, the door remains open for similar manipulations. The community must decide whether to tighten key validation or accept that protest certificates will become a new form of digital dissent.
Sources: [Hacker News – Horible public key tricks, https://maurycyz.com/projects/badcert/]