[mzs]

Basically there are standard curves and software assumed parameters matched, bad design.

edit: more detail

https://news.ycombinator.com/item?id=22048619

[SlowRobotAhead]

Ah I see. It wasn’t that they didn’t secure parts of the cert, it’s that they assumed they didn’t need to add some data. The generator was assumed standard... and surely no one would ever abuse that intention!