Enforce weak RSA in TLS I'm going to give a small talk on the mathematical background of RSA. My audience will consist mostly of software engineers and to make the mathematical stuff tangible, I wanted to demonstrate how to calculate the private key from the public key and the modulus in some reasonably realistic scenario.

What I was planning to do is to set up a simple server (Spring Boot inside Docker) which has one POST-endpoint and this endpoint should only be accessible via https.

Then I wanted to use tcpdump to capture the communication between some client and this server. Since I want to be able to decrypt this communication, I want the key exchange between client and server to be performed over RSA with the modulus so small that it can be easily factorized.

However, I fail in creating a (self signed) server certificate with decryptable RSA because the tools I know all require the primes to have some minimum size.

Does anyone know some good way to create such a certificate? Or, maybe, has someone already set up a similar scenario?
Does anyone know some good way to create such a certificate?


As you need to put the private key on the server anyways, you could just copy it of and use that for demonstration purposes.

Alternatively you could use software versions from the time when such keylength restrictions were not in place.

In particular you might want to take a look at FREAK, in particular this website (need to scroll down a bit) has a list of vulnerable server and client software that you should be able to retrieve from release archives for demonstration purposes.