Consorci AOC: EC-SectorPublic insufficient serial number entropy

This case reports that Consorci AOC issued SSL certificates with insufficient serial number entropy for certificates under the "CN=EC-SectorPublic" hierarchy. Consorci AOC said it became aware of the issue via the mozilla.dev.security.policy (m.d.s.p.) group on 2019-03-15, and that it continued issuing certificates while the discussion on severity was ongoing. On 2019-03-22 15:00 CET, Consorci AOC began investigating possible violation of BR v.1.6.3 §7.1, and on 2019-03-22 16:00 CET it identified that its systems were affected and stopped accepting new issuance requests. Consorci AOC stated that it updated its TEST environment to issue 128-bit serial number certificates and planned to update PRODUCTION and resume issuance. A Mozilla participant later stated that it appears remediation has been completed. The bug is marked RESOLVED with resolution FIXED.

1. 2019-03-15 Consorci AOC became aware via the mozilla.dev.security.policy group about 64-bit entropy for serial number generation.
2. 2019-03-22 Consorci AOC investigated and identified affected systems for CN=EC-SectorPublic and stopped accepting new issuance requests.
3. 2019-03-22 Consorci AOC updated its TEST environment to use 128-bit serial numbers and planned a PRODUCTION update.
4. 2019-04-22 A Mozilla participant indicated remediation appears to be completed.

1. 2019-03-25 Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Francesc Ferrer reported that certificates had 63 bits of entropy instead of the expected at least 64 bits, described the investigation timeline, and stated TEST was updated to issue 128-bit serial numbers with a planned PRODUCTION update.
2. 2019-03-25 Community commenter — Ryan Sleevi asked why Consorci AOC’s investigation and disclosure were delayed and requested more thorough analysis of EJBCA default configuration examination and future timeliness steps.
3. 2019-03-26 Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Francesc Ferrer responded that Consorci AOC viewed the issue as a compliance matter, described checks of EJBCA default settings and TEST/PRODUCTION, and stated PRODUCTION would be updated with 128-bit serial numbers.
4. 2019-04-03 Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Francesc Ferrer clarified that they first became aware on 2019-03-15, continued issuing while severity was discussed, and provided additional details including a stopped-acceptance date and a CT reference.
5. 2019-04-08 Community commenter — Ryan Sleevi asked whether Consorci AOC received notice from EJBCA (citing another bug) and pressed for explanation of the delay and monitoring gaps.
6. 2019-04-12 Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Francesc Ferrer said notice never arrived from PrimeKey, identified two root causes (lack of people monitoring mdsp and an incorrect incident management procedure), and listed improvements including increased mdsp monitoring resources and incident procedure enforcement.
7. 2019-04-22 Fastly representative — W. Thayer stated that it appears all remediation has been completed.