GlobalSign: AT&T Insufficient Serial Number Entropy

GlobalSign discovered a compliance issue related to insufficient serial number entropy in certificates issued by AT&T, a customer using an on-premise CA. Upon notification, AT&T was instructed to halt issuance and update their configurations. They successfully upgraded their EJBCA version to support 128-bit serial numbers and began reissuing certificates. By April 16, 2019, all misissued certificates with 63-bit serial numbers had been revoked. GlobalSign is in the process of closing down all subordinate CAs operated by third parties, with a target completion date of August 2019 for most, while ensuring future compliance.

1. 2019-03-13 GlobalSign notified AT&T of the serial number issue and instructed them to stop issuance.
2. 2019-04-16 All misissued certificates with 63-bit serial numbers were revoked.
3. 2019-04-24 GlobalSign confirmed plans to close down all subordinate CAs hosted by third parties.

1. 2019-03-16 Fastly representative — Doug Beattie posted an incident report detailing the compliance issue with AT&T's certificates.
2. 2019-03-20 Community commenter — AT&T provided a status update on their upgrade to support 128-bit serial numbers.
3. 2019-04-04 Community commenter — AT&T reported revocation of over 42,000 certificates as part of their remediation efforts.
4. 2019-04-24 Fastly representative — Confirmation received that GlobalSign is finalizing the closure of subordinate CAs.