← Government of The Netherlands, PKIoverheid (Logius) cases
Bugzilla #1535871
Certificate Problem Report
PKIoverheid: KPN Insufficient Serial Number Entropy
RESOLVED
FIXED
Government of The Netherlands, PKIoverheid (Logius)
AI Summary
The PKIoverheid CA identified a significant issue regarding insufficient entropy in the serial numbers of TLS certificates issued by KPN between September 30, 2016, and March 5, 2019. This problem was first noted during discussions in the Mozilla security policy community. Affected certificates were found to potentially include around 22,000 TLS certificates. The CA has since implemented a remediation plan, including the revocation of non-compliant certificates and the transition to using longer serial numbers. As of the latest updates, all affected certificates have been revoked, and measures have been put in place to prevent similar issues in the future.
Chronology
- KPN begins investigation into serial number entropy issue.
- Logius PKIoverheid orders KPN to investigate and revoke affected certificates.
- All certificates in scope of Mozilla Policy have been CT logged.
- All affected certificates have been revoked.
Participants
Wayne Thayer
Jochem van den Berge
Ryan Sleevi
Jorik van't Hof
External References
Similar Local Cases
PKIoverheid: CIBG insufficient serial number entropy
Staat der Nederlandend / PKIoverheid: Non-BR-Compliant OCSP Responders
GoDaddy: Insufficient serial number entropy
QuoVadis: N/A in EV serialNumber field
Asseco DS / Certum: Failure to revoke intermediate certificates within the BR time period
Entrust: IP Address in dNSName form
TrustCor: Insufficient Serial Number Entropy
Camerfirma: Unrevocation of MULTICERT SSL Certification Authority 001 certificate