SECOM: Insufficient Serial Number Entropy

SECOM Trust Systems CO., LTD. reported an incident regarding insufficient entropy in the serial numbers of certificates issued. The issue was first identified through discussions in the Mozilla mailing list on March 7, 2019. SECOM began investigating the problem on March 8, 2019, and acknowledged that they had not stopped issuing certificates while working on a fix. The CA committed to resolving the issue by implementing a configuration change to ensure compliance with entropy requirements. By May 13, 2019, SECOM confirmed that remediation for all affected intermediate CAs had been completed.

1. 2019-03-07 SECOM became aware of insufficient serial number entropy through a discussion in the Mozilla mailing list.
2. 2019-05-13 SECOM completed remediation for all affected intermediate CAs.

1. 2019-03-27 Secom representative — SECOM submitted an incident report regarding insufficient serial number entropy.
2. 2019-03-27 Community commenter — Requested clarification on the timeline and actions taken by SECOM.
3. 2019-04-02 Secom representative — Confirmed plans to change the configuration of EJBCA to 16 bytes for serial numbers.
4. 2019-04-10 Secom representative — Reported completion of remediation for several intermediate CAs.
5. 2019-05-13 Secom representative — Announced that remediation for the remaining intermediate CAs was completed.
6. 2019-05-17 Fastly representative — Confirmed that remediation has been completed.