TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A November 2026 project described how to encode a visible protest message in the RSA modulus of a valid TLS certificate. The author says the method can retain a working private key, but the source does not report independent testing or establish that a certificate authority has verified the demonstration. The example raises questions about what certificate checks do—and do not—guarantee.
A project published on November 8–9, 2026, describes how to place a readable protest message inside the RSA public key in a TLS certificate while still generating a corresponding private key. The demonstration uses a certificate for maurycyz.com and criticizes certificate management and trust practices, but the source does not establish that the certificate was independently tested or that the method affects other websites.
The author calls the project a “protest certificate”, arguing that HTTPS encryption is useful but that the certificate system imposes burdens on website operators. The report points to certificate renewal and the need to keep automated certificate tools connected to domain or server infrastructure. It also criticizes certificate authorities’ trust practices, citing a separate example involving a key with the value “4”; the provided material does not independently verify that account.
The technical method uses the RSA modulus, a number formed from two prime factors and included in the public key. The author says a certificate authority used in the demonstration would not accept a nonstandard public exponent, so the message is encoded in the modulus instead. The write-up describes adjusting the modulus and selecting a nearby prime factor so that the resulting key can be used to produce a certificate request.
The report includes a terminal command and a base64-encoded certificate excerpt that appears to contain the message. Because base64 groups bytes in sets of three, the author notes that message placement must be adjusted to keep the text readable. The supplied article ends mid-explanation, so it does not give a complete account of the final alignment process or report independent confirmation of the certificate’s operation.
What the Certificate Can Show
The demonstration draws attention to a gap between certificate issuance and the strength of the underlying cryptographic key. A certificate authority can verify a domain and sign a certificate request, but that process does not, by itself, establish that a key was generated securely or that its private component is protected. The project’s visible text is a protest; its broader point is that details embedded in a public key may not receive the scrutiny a website visitor assumes.
For readers, the distinction matters because TLS certificates are part of how browsers authenticate websites as well as encrypt connections. The project does not show that ordinary certificates are broadly unsafe, nor that the demonstrated certificate can be used to impersonate other sites. It illustrates a particular construction and raises a question about how operators, certificate issuers and software validate unusual keys.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet with Bluetooth and Color Touchscreen
Ledger Nano Gen5 Crypto Wallet, Black
LG UltraGear 32GX870A-B 32-inch 4K OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How RSA Fits the Demonstration
In RSA, the public key contains a modulus, n, and a public exponent, commonly 65,537. The private key includes a private exponent tied mathematically to the prime factors of the modulus. A public key can be shared in a certificate; the private key is what allows its holder to perform operations such as signing during a secure connection.
The author’s approach is to start with prime factors, modify the modulus to carry text, then adjust a factor so the product matches the altered value. The report says the new factor is rounded to a nearby prime, with changes intended to leave the message in the upper portion of the modulus intact. This is the author’s description of the technique, not an independent cryptographic audit.
The project frames the work as a protest rather than an attack, and says it still aims to encrypt web traffic. It contrasts that goal with earlier protest-certificate efforts that, according to the author, did not seek to preserve encryption. The provided source describes a specific website and certificate, not a wider change to TLS standards or certificate-authority policy.
““The best choice is a protest certificate.””
— The project author
Questions About Key Validation
The source does not provide an independent audit confirming that the key and certificate work as described, or specify which certificate-authority checks were performed beyond the author’s account. It also does not establish the practical security of the resulting RSA key or whether browsers and other clients accept it consistently.
The report’s discussion of a certificate authority accepting a key value of “4” is not supported by a linked technical analysis in the material supplied here. The broader claim that certificates are issued over plaintext connections is also presented as the author’s criticism; the source does not explain the issuance process in enough detail to assess that statement. The precise implications for certificate policy and website security remain unclear.
Further Verification Needed
The next useful step would be independent testing of the published certificate and key, including confirmation that the certificate is accepted by common TLS clients and that the private key supports the expected cryptographic operations. Reviewers would also need to assess the key’s security rather than infer it from the visible message or the fact that a certificate was issued.
The source material does not announce a response from a certificate authority, browser maker or standards group, and it gives no timeline for follow-up. Until such evidence is available, the project is best understood as a documented technical protest and a claim about validation practices—not proof of a general weakness in TLS.
Key Questions
What does the project claim to demonstrate?
It describes embedding readable text in the RSA modulus of a TLS certificate while constructing a corresponding private key. The source does not include independent verification.
Does this mean TLS encryption is broken?
No such conclusion is established by the report. It describes one certificate construction and does not show that TLS as a whole, or other websites, can be compromised.
Why put the message in the public key?
The author says the public key was the part of the certificate they could directly control. The modulus also offers space in which the report says text can be encoded.
Has a certificate authority confirmed the claims?
The supplied material does not include an independent confirmation or a response from a certificate authority. It says a certificate was obtained, but the claim is not independently established here.
Source: maurycyz.com
