The Limits of Fingerprint Blocklists: A Reproducible Java Certificate Bypass
Summary
The article analyzes how Java's fingerprint-based blocklists can fail when a certificate is re-encoded, showing that SHA-256 fingerprints can change while the certificate remains valid in the trust store. It reproduces re-encoding scenarios for both ECDSA- and RSA-signed intermediates from the eMudhra incident and advises security teams to verify mitigations in their runtimes and trust stores, rather than relying solely on blocklists.