In March 1999, Netscape 4.51 shipped with two 512-bit RSA root certificates from E-Certify, a defunct Canadian certificate authority — one trusted for SSL, one for S/MIME. RSA-155, the 512-bit factoring challenge number, was factored later that same year. The keys were already too weak on the day the browser started trusting them.
Matthew McPherrin factored both of them on a desktop.
The archaeology is the fun part:
- Root certificates were bundled inside browser installers, so both the Netscape and Internet Explorer archives on archive.org contain decades of trust decisions
- Extracting every bundled root and filtering by key size turned up the pair of E-Certify 512-bit roots, removed by Netscape in 2002
- CADO-NFS on a Ryzen 9 5950X took 32 hours for the Gold Server key and 29 hours for the Gold Client key
- The two primes give you back the private key, so he could issue certificates from a CA that stopped existing a quarter century ago
- Verifying that took a custom TLS server written in Go, because Netscape 4.51 has essentially zero TLS overlap with anything modern; the result is live at e-certify.fly.dev and rates an F from SSL Labs
The transferable lesson is that key strength is not a property of an algorithm, it is a property of an era and an attacker budget:
- A 512-bit RSA key that was questionable in 1999 costs a home desktop roughly a day in 2026
- The early Web PKI had no minimum key size, so root trust got shipped as casually as any other installer asset
- A test VeriSign 512-bit code-signing CA from IE 3.02 was factored by Steve Weis in about an hour on a GPU cluster
- “Deprecated” is not “infeasible” — the argument for moving off 1024-bit RSA is about who can afford the compute, not whether it is possible
A nice reminder that the oldest, least glamorous artifacts are often the most instructive: the 90s browser installers are a record of decisions nobody would defend today, and they are still sitting on archive.org in a zip file.
Archive: ancient roots and the repo.