Google Trust Services: 63 bit serial numbers in some certificates

Google Trust Services (GTS) identified that some certificates issued utilized EJBCA, resulting in serial numbers with only 63 bits of effective entropy, which is below the required standard. Upon discovering this issue, GTS acknowledged it as a misissuance but stated it did not pose a material security risk. They have since replaced and revoked approximately 95% of the affected certificates, with plans to address the remaining ones before their expiration. The incident was prompted by discussions regarding another CA's serial number generation issues, leading GTS to review their own practices.

1. 2019-02-22 Concerns raised about serial entropy in Dark Matter certificates.
2. 2019-02-26 GTS begins reviewing serial number generation behavior.
3. 2019-03-01 GTS decides to replace and revoke all affected certificates.
4. 2019-03-05 Certificate revocation begins.
5. 2019-04-08 All remaining affected certificates were revoked.