GoKawiilBlogger embeds protest message inside a valid TLS certificate's public key
A developer crafted a 'protest certificate' for maurycyz.com by choosing a private key whose resulting public key bytes spell out a readable ASCII message criticizing the SSL/TLS certificate system, then had it issued normally through Let's Encrypt. The post notes certificate authorities never verify that a submitted public key was generated from truly random data, citing a prior case where a CA issued a certificate using the trivial private key value '4'.
GoKawiil's interpretation of the reporting above, not reported fact.
The demonstration suggests that the certificate issuance process checks cryptographic validity but not whether a key was generated securely, meaning weak or crafted keys can slip through undetected unless someone actively tries to factor or analyze them. This could be read as a critique, per the author, of the ACME/CA ecosystem's practical trust model despite its cryptographic design, and highlights that automation and compliance checks do not guarantee genuine security hygiene.
- A certificate was issued with a public key deliberately engineered to display a hidden text message.
- The author argues certificate authorities do not verify randomness or security of submitted public keys.
- A prior real-world case reportedly involved a CA issuing a certificate with the private key value '4'.
Source: maurycyz.com, 2026-11-10
Published there as: “Horible public key tricks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.