SecurityLobstersabout 4 hours ago
Sonatype Reproduces Java Certificate Bypass
4 min read
Sonatype Research Labs confirmed that Java's exact-fingerprint blocking fails against re-encoded certificates using ECDSA and RSA signatures. Tests show re-encoding changes SHA-256 fingerprints while maintaining validation. This incident stems from eMudhra key compromises on October 20, 2026, revealing a limit in current mitigation strategies for Java trust stores.
Level
Hype check
Tap to vote and see what everyone thinks.