The Limits of Fingerprint Blocklists: A Reproducible Java Certificate Bypass
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Sonatype researchers found that Java's blocked.certs list, which matches certificates by SHA-256 fingerprint, rejected listed intermediates from the eMudhra incident but accepted re-encoded versions of the same certificates that still validated in tested configurations.