@aurynn incompetent handling of generating / signing intermediate CA keys lead to very weak keys being signed (many 0 bits followed by a few 1s).

Mozilla / Google have blocked all the known affected intermediates (a couple of days ago) and today detrusted the specific root CA that signed them too, as a precaution.

From skim reading it looks like *most* of the intermediate CA affected didn’t get used for production signing yet.

https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

@aurynn you're about to discover that your day has been brought to you by the number 4