The Weakest Link in PKI Is the Trust Nobody Retired

A certificate authority key created 30 years ago can fall to computing power that exists today. The surprising part is not the math. It is that trust granted in the 1990s may still be active somewhere in a 2026 system.

What It Means to Factor an RSA Key

An RSA public key contains a very large number produced by multiplying two prime numbers.

Factoring means working backward from that public number to recover the original primes. With a sufficiently large key, doing so takes an impractical amount of time. Once the primes are known, however, an attacker can derive the corresponding private key.

Commercial systems used 512-bit RSA in the 1990s. That was expensive to break at the time. It is nowhere near adequate now.

RSA-155, a 512-bit challenge number, was factored in 1999. The 768-bit RSA challenge was factored in 2009, with the results published the following year. Modern services generally use RSA keys of at least 2,048 bits.

The label still says RSA. The security level is completely different.

A Broken CA Key Has a Much Larger Blast Radius

If someone steals a website’s private key, the damage is usually limited to that site. A certificate authority, or CA, sits higher in the hierarchy.

CAs sign certificates that identify websites, software publishers, devices, and other CAs. Browsers and operating systems verify those signatures against their trusted root stores. That hierarchy is the chain of trust behind much of today’s public-key infrastructure.

Factor an old CA’s public key, and an attacker may be able to reconstruct its private key and imitate its signatures. Under the right conditions, that could enable forged server certificates or fraudulent code-signing certificates.

A recovered key is not a universal skeleton key. Modern browsers also check expiration dates, permitted uses, revocation status, and signature policies. They aggressively reject short RSA keys and obsolete algorithms such as SHA-1.

The softer targets are outside Chrome and Safari. Think abandoned industrial controllers, aging Java runtimes, medical equipment, embedded devices, and internal applications nobody wants to touch because “they still work.” Attackers do not need to defeat the strongest current platform. They need to find one trust store that was never replaced.

Expired Does Not Always Mean Harmless

Certificates have expiration dates, which makes it tempting to dismiss an old CA certificate as dead infrastructure.

The private key does not disappear when the certificate expires. A system with a broken clock, incomplete validation, or a homegrown TLS stack may still accept it. Old trust chains can also reappear when organizations verify software, documents, or archives signed years earlier.

Code signing makes this especially messy. A properly timestamped signature may remain valid after its signing certificate expires. Legacy devices may also fail to download current revocation lists or check online certificate status.

A certificate’s real lifetime does not end on the date printed inside it. It ends when the last piece of software stops trusting it.

Crypto Migration Is an Inventory Problem

Companies often treat certificate migration as a procurement task: issue a new certificate, install it, and move on. The hard part is discovering every place where the old authority remains trusted.

That inventory extends well beyond production servers. It includes employee devices, network appliances, factory equipment, firmware, container images, Java keystores, mobile apps, golden VM images, and backups that may return to service during a disaster recovery exercise.

A sensible cleanup starts with the trust relationships already in the environment:

• Build an inventory of every trusted root and intermediate CA.
• Prioritize keys using RSA-1024 or weaker and signatures based on SHA-1.
• Check whether old certificates remain in active trust stores, regardless of expiration.
• Remove unused authorities and isolate devices that cannot be updated.
• Test revocation and key-rotation procedures against the oldest supported clients.

The coming shift to post-quantum cryptography will face the same operational trap. Deploying a new algorithm may be easier than finding every forgotten system that still accepts the old one.

The Real Vulnerability Is Forgotten Trust

A cracked 30-year-old RSA key is not just an excuse to laugh at 1990s security engineering. Those systems were built for the hardware and threat models of their time.

The warning is for today: cryptography ages, but trust stores are remarkably good at becoming fossils. How many certificates in your organization still have authority long after their owners, vendors, and documentation have disappeared?