GoDaddy: Insufficient serial number entropy

GoDaddy identified a compliance issue regarding the entropy of certificate serial numbers, discovering that over 12,000 live certificates did not meet the 64-bit requirement. The issue was first noted on March 6, 2019, following discussions in the mozilla.dev.security.policy group. GoDaddy deployed a fix on March 7, 2019, and ceased issuing certificates with the defect. They also began revoking affected certificates, with a timeline for completion communicated to stakeholders. The CA has since updated its processes to ensure compliance with the Baseline Requirements.

1. 2019-03-06 GoDaddy began researching the insufficient serial number entropy issue.
2. 2019-03-07 GoDaddy deployed a fix to address the serial number issue.
3. 2019-03-12 GoDaddy reported the number of affected certificates was revised to approximately 12,152.

1. 2019-03-08 Fastly representative — Daymion Reynolds posted about the serial number issue and the timeline of actions taken.
2. 2019-03-11 Community commenter — Inquired about updates on the list of impacted certificates.
3. 2019-03-12 GoDaddy — Updated the count of impacted certificates and outlined the steps taken.
4. 2020-01-24 Fastly representative — Proposed to close the bug as 'Fixed' due to conflicting evidence.