No published test keys

What this check verifies

The checker computes the RFC 7638 thumbprint of every key in the directory and compares it with a list of published test keys. The private halves of these keys are printed in a standard, so they are public. The list holds the four example keys of RFC 9421, Appendix B.1, and the Ed25519 example key of RFC 8037, Appendix A:

1. RFC 9421 B.1.1, an RSA key.
2. RFC 9421 B.1.2, an RSA-PSS key.
3. RFC 9421 B.1.3, an ECDSA P-256 key.
4. RFC 9421 B.1.4, an Ed25519 key.
5. RFC 8037 Appendix A, an Ed25519 key.

When a directory key matches one of them, the check warns and names the key. Otherwise it passes.

The check is advisory. It lowers the score but never caps the grade and never changes the verdict.

Why it matters

Anyone can produce a valid signature with a test key, because its private key is in the RFC. A directory that publishes one lets any party sign requests that verify against your directory.

The protocol draft says test keys, including the RFC 9421 examples, must not be used in production, and that verifiers should reject them when they find them in a key directory (section 6.8). The checker warns instead of failing, in line with that SHOULD; a strict verifier rejects the key.

The draft’s own directory example (section 5.5.1) and its Ed25519 test vectors use the B.1.4 key, so a directory copied from the draft carries it.

How to fix it

1. Generate a new Ed25519 keypair and keep the private key in your secret store.
2. Publish the new public key in the directory and sign with it.
3. Remove the test key from the directory.

Keep test keys in test setups that never send requests to production sites.

References

• The Web Bot Auth protocol draft (draft-ietf-webbotauth-httpsig-protocol-00), section 6.8, forbids test keys in production and asks verifiers to reject them; Appendix C.12 lists them among deployment anti-patterns.
• RFC 9421, Appendix B.1, publishes the example keys.
• RFC 7638 defines the thumbprint the checker compares.
• How grading works explains how advisory warnings affect the score.