GlobalSign: Certificates with RSA keys where modulus is not divisible by 8

This case concerns GlobalSign certificates whose RSA key modulus was not divisible by 8. GlobalSign said it was notified via a problem report at 04:04 UTC on 17 July 2020 that such certificates had been discovered. GlobalSign stated that a code fix blocking key sizes not divisible by 8 had been deployed in production on 3 March 2020, and that the affected certificates were issued before that fix. After receiving the problem report, GlobalSign reported that compliance operators were contacted for escalation, an internal investigation was completed, and all certificates where the modulus is not divisible by 8 were revoked. GlobalSign also provided a count of affected certificates (38) and listed multiple crt.sh query links for the problematic certificates. In response to Mozilla questions about revocation timing and systemic factors, GlobalSign said it modified QA and pre-deployment checklists to include analyzing historical issuance data and described changes to how requirements templates mandate this analysis by default. Mozilla indicated the bug could be closed on or about 14 September 2020, and the bug is marked RESOLVED with resolution FIXED.

1. 2020-03-03 GlobalSign deployed a code fix blocking key sizes not divisible by 8 in production.
2. 2020-07-17 GlobalSign received a certificate problem report about RSA key moduli not divisible by 8 and completed an internal investigation.
3. 2020-07-20 GlobalSign revoked all certificates where the modulus is not divisible by 8.
4. 2020-09-14 Mozilla planned to close the bug on or about this date.

1. 2020-07-23 GlobalSign nv-sa — GlobalSign described how it became aware of the issue, provided a timeline, stated 38 affected certificates, and said all certificates with modulus not divisible by 8 were revoked.
2. 2020-07-23 Community commenter — Paul noted that CRL revocation dates appeared to be after the stated 10:11 timestamp and questioned the precision of the timestamp.
3. 2020-07-24 GlobalSign nv-sa — Arvid provided a more verbose timeline including revocation start and a revocation completion timestamp.
4. 2020-07-27 Community commenter — Ryan asked about GlobalSign’s team responsibilities and how it ensures compliance requirements are tested retrospectively, including for bug fixes and emergency changes.
5. 2020-08-10 GlobalSign nv-sa — Arvid explained GlobalSign’s change-requirement process and said QA/pre-deployment checklists were updated to analyze historical issuance data by default.
6. 2020-08-12 Community commenter — Ryan thanked GlobalSign and emphasized examining historical issuance by default as a good practice.
7. 2020-08-13 GlobalSign nv-sa — Arvid asked whether more information was needed to close the bug.
8. 2020-09-09 Mozilla representative — Bwilson stated the bug could be closed on or about 14 September 2020 unless other issues remained.