GlobalSign: Virginia Tech Insufficient Serial Number Entropy

This case concerns a technically constrained CA operated by Virginia Tech under GlobalSign that issued certificates with insufficient serial number entropy. The issue was triggered by a disclosure report received by GlobalSign, describing that certificates issued from 9/30/2016 through 4/26/2018 had serial numbers with the leading bit set to 0, resulting in 63-bit serial numbers instead of the expected at least 64 bits. GlobalSign investigated the issuance and stated that certificates issued prior to 1 August 2017 were not compliant, while certificates issued between 8/1/2017 and 4/26/2018 had sufficient serial number entropy. GlobalSign stated that Virginia Tech stopped issuing certificates on 4/26/2018 and that the CA expires on 12/9/2019. GlobalSign reported that it revoked mis-issued certificates, including a status update that 147 of 174 non-expired mis-issued certificates had been revoked, and later confirmed that all non-expired certificates with 63-bit serial numbers were successfully revoked. The bug is marked RESOLVED with resolution FIXED.

1. 2016-09-30 Virginia Tech began issuing certificates with 63-bit serial numbers under the technically constrained CA operated via GlobalSign.
2. 2017-08-01 GlobalSign reported that certificates issued on/after 1 August 2017 were compliant with sufficient serial number entropy (per its investigation).
3. 2018-04-26 Virginia Tech stopped issuing certificates under the constrained CA.
4. 2019-03-19 GlobalSign researched the Virginia Tech issuance based on the disclosure report and identified non-compliant certificates prior to 1 August 2017.
5. 2019-03-26 GlobalSign reported revoking 147 of 174 non-expired mis-issued certificates.
6. 2019-04-08 GlobalSign confirmed all non-expired certificates with 63-bit serial numbers were successfully revoked.

1. 2019-03-20 Community commenter — Reported that Virginia Tech issued serial numbers with leading bit set to 0 (63 bits) instead of the expected at least 64 bits during 9/30/2016–4/26/2018.
2. 2019-03-20 Community commenter — Explained GlobalSign’s awareness via a disclosure report, provided investigation details, stated the CA stopped issuing on 4/26/2018, and described planned revocation timing.
3. 2019-03-20 Community commenter — Created an attachment listing the misissued certificates.
4. 2019-03-20 Community commenter — Asked for the events on 1 August 2017 that changed compliance and for details on supervision and why detection was delayed.
5. 2019-03-20 Community commenter — Said Virginia Tech changed to 128-bit serial numbers on 1 August 2017 and that GlobalSign’s initial analysis did not include this CA because it had not been issuing since April 2018.
6. 2019-03-20 Community commenter — Acknowledged Virginia Tech’s proactive change and left a needinfo while waiting for a revocation timetable/plan.
7. 2019-03-26 Community commenter — Updated that Virginia Tech updated its EJBCA setting to 128 bits and reported revocation of 147 of 174 non-expired mis-issued certificates, requesting an extension for remaining service owners.
8. 2019-04-08 Community commenter — Confirmed that all non-expired certificates with 63-bit serial numbers had been successfully revoked.