PKI and certificates
9 guides tagged PKI and certificates, grouped by topic, with the SDLC phase and role each is written for.
- SDLC phases
Identity & cryptography
9 guidesHash collisions and digital signatures: MD5, SHA-1 and what to use
Distinguish collisions from preimages, follow a colliding pair through signing and verification, and retire MD5 and SHA-1 from the verifiers that still accept them.
Maintenance · Developers
Weak RSA key generation: shared primes, ROCA and safe keys
Recover a toy RSA factor with a greatest common divisor, distinguish shared primes, structured primes, duplicate keys and key length, and check a fleet of real public keys.
Maintenance · Developers
Flame: MD5 certificate forgery
Follow how a weak digest and an overpowered certificate trust path enabled forged code-signing authority, without equating the event with RSA key theft.
Design, Release, Maintenance · Developers
FREAK and Logjam: export-grade key exchange
Trace two export-grade downgrade paths and separate RSA factorization from finite-field Diffie–Hellman discrete logarithms.
Design, Maintenance · Developers
DROWN: one RSA key across incompatible protocols
Map an RSA key across services to see how an SSLv2 oracle could compromise TLS traffic on a different endpoint.
Design, Development · Developers
ROCA: structured RSA key generation
Understand why mathematically structured RSA primes were factorable despite normal key lengths, then plan replacement around generation provenance.
Design, Maintenance · Developers
Operate TLS and certificates: configuration, renewal and verification
Configure a modern TLS profile with hybrid post-quantum key exchange, automate renewal for certificate lifetimes that fall to 47 days, and verify every termination point with a fresh handshake.
Design, Maintenance · Developers, Platform engineers and SREs
Choose cryptographic algorithms and parameters by job
A sourced quick reference for October 2026: which algorithm and parameters to use for encryption, hashing, passwords, MACs, signatures, key agreement, key derivation, randomness and TLS, the matching APIs in Node.js, Python, Java, Go and .NET, and where post-quantum migration stands.
Design, Development · Developers
Case study: certificate expiry outages at Ericsson (2018) and Microsoft Teams (2020), and Equifax's blind spot
How an expired certificate inside Ericsson's core-network software cut mobile data for millions in about 11 countries, how an expired authentication certificate took Microsoft Teams offline, how an expired inspection certificate left Equifax blind for 19 months, through its 2017 breach, and the inventory, automation and testing that prevent each.
Maintenance · Developers, AppSec engineers, Platform engineers and SREs
Practice
Insecure randomness lab: Generate unguessable API keys
An integration service issues 16-character API keys from Math.random, which is not built to be unpredictable. Take every character from the system’s secure generator, lengthen the key and map bytes without bias.
Improper TLS certificate validation
TLS protects a connection only if the client checks who is at the other end.