Considering the huge amount of RSA certs which have been generated, wouldn't there probably be a small number of certs where one of the primes which may have actually been a composite? Has this ever been a problem in the wild?
I think RSA with such a p & q will fail signature verification & decryption. So in these cases, I don't think the tools would give a proper error message & this may lead to a major confusion.
And if the composite number is in fact a Carmichael number, then I think RSA would work as intended, but would be less secure than it was intended to be.
I know what with enough rounds of the Miller-Rabin algorithm, the probability of something like happening is very small. But I am just wondering if it has happened & been detected