Class DistrustedKeys

Namespace

EncDotNet.S100.Collections.Net

Assembly

EncDotNet.S100.Collections.dll

Public keys this library refuses in any certificate chain, whatever the operating system's trust store says: CA keys known to be compromised. Each is matched by the SHA-256 of its DER-encoded SubjectPublicKeyInfo, so every certificate carrying the key is refused, including cross-signed copies under another root.

public static class DistrustedKeys

Inheritance

object

DistrustedKeys

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

eMudhra intermediates (October 2026): the private keys of eight intermediates from one April 2025 key ceremony were generated with trivially small scalars and can be recovered by anyone. Each key was certified twice, under emSign Root TLS/CS CA - G3 and cross-signed under Sectigo's AAA Certificate Services. Browsers block them through CRLSets and OneCRL, but a .NET client on Linux trusts the distro's CA bundle without checking revocation or Certificate Transparency until that bundle is updated. The list matches Go's crypto/x509 distrustedSPKIHashes and Mozilla's impacted-intermediates.json; see Mozilla bug 2083449.

Entries stay: a compromised key is never trustworthy again.

Properties

SpkiSha256

The distrusted keys, as lower-case hex SHA-256 hashes of their SubjectPublicKeyInfo.

public static IReadOnlyCollection<string> SpkiSha256 { get; }

Property Value

IReadOnlyCollection<string>

Methods

FindDistrusted(IEnumerable<X509Certificate2?>)

The first of certificates that carries a distrusted key, or null.

public static X509Certificate2? FindDistrusted(IEnumerable<X509Certificate2?> certificates)

Parameters

certificates IEnumerable<X509Certificate2>

Returns

X509Certificate2

FindDistrusted(X509Certificate2?, X509Chain?)

The first certificate in chain's elements, or certificate itself, that carries a distrusted key; null when none does.

public static X509Certificate2? FindDistrusted(X509Certificate2? certificate, X509Chain? chain)

Parameters

certificate X509Certificate2

chain X509Chain

Returns

X509Certificate2

IsDistrusted(X509Certificate2)

Whether certificate carries a distrusted key.

public static bool IsDistrusted(X509Certificate2 certificate)

Parameters

certificate X509Certificate2

Returns

bool

SpkiSha256Of(X509Certificate2)

The lower-case hex SHA-256 of certificate's SubjectPublicKeyInfo.

public static string SpkiSha256Of(X509Certificate2 certificate)

Parameters

certificate X509Certificate2

Returns

string