[SSL Observatory] Duplicate private keys

[Andy Isaacson]

On Mon, Apr 04, 2011 at 11:35:55PM -0700, Chris Palmer wrote:
> On Apr 4, 2011, at 7:02 PM, Andy Isaacson wrote:
> 
> > There are thousands of certs in the observatory with duplicate public
> > exponent values but distinct, valid Subject strings.  The most

[as pointed out, I meant duplicate modulus.]

> > promiscuous public exponent is present in 780 distinct certificates (all
> > with distinct CN= strings).  The ones I checked appear to be low-rent
> > but legitimate commercial websites.  They're not all hosted on the same
> > IP netblock or ISP.
> 
> Are these possibly also among the weak Debian keys? That might explain
> the re-use.

No, the most frequent Debian bad key I could find only had 2 instances
in valid_certs.

-andy