DigiCert / InfoCert: Insufficient Serial Number Entropy (sub CA incident report)

This case is an incident report for a DigiCert sub CA under the InfoCert hierarchy, concerning insufficient serial number entropy. The bug was separated out from Bug 1389172 to request an incident report specific to this sub CA. DigiCert stated it first became aware of the problem via a certificate problem report received on August 10. DigiCert said the sub CA was revoked in June 2017, but that it forgot to upload the sub CA to OneCRL until right after receiving the certificate problem report. DigiCert also stated that it stopped issuance by revoking the sub CA, and that the InfoCert issues cannot happen again. For remediation, DigiCert said it is implementing closer monitoring for mis-issuances and, as a process change, will add sub CAs to OneCRL before revoking and create a revocation checklist for intermediates. The bug was resolved as FIXED.

1. 2017-06-01 The InfoCert sub CA was revoked (as described by DigiCert in the thread).
2. 2017-08-01 DigiCert stated the sub CA revocation date as August 1, 2017 and later updated CCADB accordingly.
3. 2017-08-04 DigiCert added the revocation to the CCADB (per a thread correction).
4. 2017-08-07 DigiCert changed OneCRL status to Ready to Add (per the thread correction).
5. 2017-08-10 DigiCert received a certificate problem report email and identified the OneCRL upload gap.
6. 2017-09-13 DigiCert described process remediation: add sub CAs to OneCRL before revoking and create a revocation checklist.

1. 2017-09-07 Mozilla representative — Opened the separated bug to request an incident report specific to the InfoCert sub CA and asked for details per Mozilla’s incident report guidance.
2. 2017-09-08 DigiCert — Provided incident-report answers, stating the problem was reported via a certificate problem report on August 10 and that the sub CA was revoked but not uploaded to OneCRL until after the report.
3. 2017-09-08 Community commenter — Asked what process changes DigiCert made to ensure timely upload to OneCRL for external sub CA relationships.
4. 2017-09-09 Community commenter — Corrected revocation and CCADB/OneCRL dates, stating the sub CA was revoked on August 1, CCADB updated on August 4, OneCRL status set to Ready to Add on August 7, and the issue was discovered on August 10 via an email to the Mozilla Dev Security Policy list.
5. 2017-09-13 DigiCert — Described remediation steps: add sub CAs to OneCRL before revoking and create a revocation checklist for intermediates.
6. 2017-09-21 DigiCert — Asked whether the bug was ready to close and if more information was needed.
7. 2017-09-22 Community commenter — Questioned the discrepancy between revocation dates referenced in earlier comments and the CRL’s suggested date.
8. 2017-09-22 DigiCert — Attributed the date discrepancy to pulling information from the CCADB while tired, and apologized for the confusion.