Buypass: Insufficient Serial Number Entropy

Buypass reported an incident involving two intermediate certificates issued in December 2016 that did not comply with the entropy requirements outlined in BR 7.1. The issue was identified following a discussion on the mozilla.dev.security.policy list, leading to immediate actions including the issuance of new compliant certificates and communication with affected customers. The problematic certificates were eventually revoked on June 27, 2019, after a majority of customers had updated to the new certificates.

1. 2019-03-21 Buypass became aware of noncompliance with entropy requirements.
2. 2019-03-25 New compliant intermediate certificates were issued.
3. 2019-05-15 Deadline set for customers to replace affected certificates.
4. 2019-06-27 The two affected intermediate certificates were revoked.