E-Tugra: Insufficient serial number entropy

E-Tugra identified an issue with insufficient entropy in the serial numbers of their certificates, which was reported through both community feedback and internal monitoring. The CA took immediate action, increasing the serial number length from 8 bytes to 16 bytes and revoking all affected certificates. The issue was resolved by March 13, 2019, and E-Tugra has since updated their internal incident reporting procedures to ensure timely notifications in the future. The incident report was submitted on April 5, 2019, after the revocation process was completed.

1. 2019-03-03 Announcement from EJBCA regarding the entropy issue.
2. 2019-03-04 Investigation of the system began.
3. 2019-03-13 Serial number length increased to 16 bytes.
4. 2019-03-14 Reissue of all affected certificates started.
5. 2019-04-05 Incident report submitted.