Camerfirma: Multicert SSL CA 001: Insufficient serial number entropy

Multicert identified an issue with insufficient entropy in the serial number generation for certificates issued by their SSL Certification Authority 001, which resulted in only 63 bits of effective entropy. Following the discovery, they halted certificate issuance, investigated the issue, and implemented a fix to ensure a minimum of 120 bits of entropy. The affected certificates were revoked in stages, with a total of 705 certificates revoked by July 2, 2019. The incident raised concerns regarding compliance with Baseline Requirements and highlighted the need for improved communication and processes for certificate management.

1. 2019-03-08 Identified ongoing discussions about serial number entropy.
2. 2019-03-11 Confirmed the issue affected their systems and halted certificate issuance.
3. 2019-03-12 Deployed a fix and resumed certificate issuance.
4. 2019-07-02 Completed revocation of 705 affected certificates.