QuoVadis: DarkMatter Insufficient Serial Number Entropy

The bug concerns an incident report posted by Corey Bonnell to mozilla.dev.security.policy alleging that DarkMatter (DM) mis-issued certificates under BRs Section 7.1 regarding serial number requirements. DM investigated and stated that its platform setting produced 64-bit serial numbers and that certlint/cablint/zlint did not complain, concluding it was compliant with the cited wording. After further discussion, DM committed to move to 128-bit serial numbers and later reported that, as of 2 March 2019 8:00pm UAE time, all DM active public trust TLS certificates with 64-bit serial numbers had been revoked. DM also reported scheduling key ceremonies to update root certificates with WebTrust Auditors and later provided updates that root certificates were rolled over with updated serialNumber settings and that intermediate certificates were scheduled for update. DM stated that the final batch of SubCAs was re-issued on 10 April 2019 and that all affected Roots, SubCAs, and End Entities had been updated, considering the matter resolved. The bug was marked RESOLVED with resolution FIXED.

1. 2019-02-23 An external incident report was posted alleging BR Section 7.1 serial number nonconformance for DarkMatter certificates.
2. 2019-03-02 DarkMatter revoked all active public trust TLS certificates with 64-bit serial numbers.
3. 2019-03-27 Key ceremonies were scheduled to update root certificates with WebTrust Auditors.
4. 2019-04-10 DarkMatter re-issued the final batch of SubCAs.
5. 2019-04-24 DarkMatter reported that all affected Roots, SubCAs, and End Entities had been updated and the matter was resolved.

1. 2019-03-01 Community commenter — Scott Rea representing DarkMatter posted the incident report details and a timeline to the mozilla.dev.security.policy mailing list, citing BRs Section 7.1 and listing affected certificates.
2. 2019-03-03 DarkMatter LLC — Scott Rea updated the bug stating that, by 2 March 2019 8:00pm UAE time, all DarkMatter active public trust TLS certificates with 64-bit serial numbers had been revoked.
3. 2019-03-24 DarkMatter LLC — Scott Rea scheduled key ceremonies to update root certificates for 27 March 2019 with WebTrust Auditors.
4. 2019-04-02 DarkMatter LLC — Scott Rea reported that the original root certificates submitted to Mozilla were updated with serialNumber rollovers and that intermediate certificate key ceremonies were scheduled.
5. 2019-04-24 DarkMatter LLC — Scott Rea reported that the final batch of SubCAs was re-issued on 10 April 2019 and that all affected entities had been updated, considering the matter resolved.
6. 2019-04-26 Community commenter — Wayne Thayer stated it appears remediation is complete.