So, I've always been somewhat annoyed at SSL/TLS. It requires everyone to go through a complex ACME dance just to put up a public website. Worse, certificates expire every few months, so it's not a one and done thing, even with automation, maintaining a certificate requires care to ensure the ACME client always has access to DNS records or the web server.
The whole system doesn't even work because certificates are issued over plaintext connections, and trusted certificate authorities use very secure keys like 4. There is prior art of protest SSL implementations, but I do actually want to encrypt web traffic. Passive eavesdropping is a real risk, but preventing it doesn't require the whole certificate thing; therefore, the best choice is a protest certificate.
The only part of the certificate I directly control is the public key. Therefore, the simplest way to obtain a bad certificate is to use a vanity private key such as one of the most elite primes. However, while the resulting public key would be weak, no one would know unless they try to break it.
A good protest should be obvious. To generate a key, pick two large prime numbers (p and q) and multiply them to yield the modulus (n). Pick a small number, e as public exponent.
The RSA public key is composed of the modulus (n) and the public exponent. Encryption requires knowing e (public): ciphertext = plaintext^e mod n. The private key contains the modulus and the private exponent (d) which is chosen to be the multiplicative inverse of e modulo n.
Decryption requires knowing d (private): ciphertext^d mod n = plaintext^e^d mod n = plaintext^(e*d) mod n = plaintext^1 mod n = plaintext. Ok, back to vanity ...
Source: Hacker News · Summarized by HeadlinesBriefing