StartCom: duplicate serial numbers

Kurt Roeckx reported that StartCom had about 30 cases where the same serial number was used for multiple certificates. He described this as a serious issue and asked StartCom for feedback and the list of affected certificates. StartCom (Eddy Nigg) responded that it had been aware of the issue for some time and had tried to reduce duplicates since the beginning of the year, attributing the problem to a queue/capacity issue and stating that a hardware upgrade was planned for Nov–Dec. StartCom said it preferred not to revoke the affected certificates because revocation would affect both certificates at the same time, and it stated that it had not received a compliant about a duplicate serial error from any user so far. In 2017, Gerv resolved the bug, noting that if StartCom became trusted again, they were unlikely to have the same issues. The bug is marked RESOLVED with resolution WONTFIX.

1. 2014-06-24 Kurt Roeckx reported that StartCom had multiple certificates sharing duplicate serial numbers.
2. 2014-09-22 StartCom responded that duplicates had been reduced and that a planned hardware upgrade would address the underlying queue/capacity issue.
3. 2017-03-20 Mozilla resolved the bug.

1. 2014-06-24 Roeckx representative — Reported that he found about 30 StartCom certificate cases where the same serial number is used for multiple certificates.
2. 2014-07-29 Roeckx representative — Asked Eddy for feedback, stating he found the issue serious and had not received a response yet.
3. 2014-08-18 Startcom representative — Asked Kurt to provide the list of certificates he found.
4. 2014-09-09 Roeckx representative — Stated he had already provided the information in the bug.
5. 2014-09-09 Mozilla representative — Asked Eddy what news there was regarding the issue.
6. 2014-09-21 Velox representative — Argued it was time to publicly confirm the BR violation and provided certificate examples.
7. 2014-09-22 Startcom representative — Explained StartCom had been aware, reduced duplicates since the beginning of the year, cited a queue/capacity issue with a planned Nov–Dec hardware upgrade, and said it preferred not to revoke the affected certificates.
8. 2017-03-20 Mozilla representative — Resolved the bug, stating that if StartCom became trusted again, they were unlikely to have the same issues.