Under the Baseline Requirements, v1.4.8 (current version), 4.9.1.1,

"The CA SHALL revoke a Certificate within 24 hours if one of more of the
following occurs:
 9. The CA is made aware that the Certificate was not issued in accordance
with these requirements or the CA's Certificate Policy or Certification
Practice Statement"

Since the passage of Ballot 165 (
https://cabforum.org/2016/07/08/ballot-164/ ), adopted in version 1.3.7
"Effective September 30, 2016, CAs SHALL generate Certificate serial
numbers greater than zero (0) containing at least 64 bits of output from a
CSPRNG."

So these were not issued in accordance with these Requirements, and thus
subject to revocation.

On Thu, Aug 10, 2017 at 7:55 AM, Fiedler, Arno via dev-security-policy <
dev-security-policy@lists.mozilla.org> wrote:

> Hello Jonathan,
>
> the certificate has 64 bits of entropy in the "DNqualifier" field instead
> of the serial number field.
>
> Since 2012 we used this way of adding random bits to certificates to
> mitigate  preimage attacks
> From a security perspective the amount of Entropy in the certificate
> should be reasonable.
>
> Do you see a security need for revoking the certificate?
>
> Viele Grüße
>
> Arno Fiedler
> Standardization & Consulting
> Bundesdruckerei GmbH
> Kommandantenstraße 18 · 10969 Berlin · Deutschland
>
> Tel. :    + 49 30 25 98 - 3009
> Mobil: + 49 172 3053272
>
> arno.fied...@bdr.de · www.bundesdruckerei.de
>
> Sitz der Gesellschaft: Berlin · Handelsregister: AG Berlin-Charlottenburg
> HRB 80443. USt.-IdNr.: DE 813210005
> Aufsichtsratsvorsitzender: Willi Berchtold
> Geschäftsführer: Ulrich Hamann (Vorsitzender), Christian Helfrich
>
> This message is intended only for the use of the individual or entity to
> which it is addressed, and may contain information that is privileged,
> confidential and exempt from disclosure under applicable law. If the reader
> of this message is not the intended recipient, or the employee or agent
> responsible for delivering the message to the intended recipient, we hereby
> give notice that any dissemination, distribution or copying of this
> communication is strictly prohibited. If you have received this message in
> error, please delete the message and notify us immediately.
>
> Diese Nachricht kann vertrauliche und gesetzlich geschützte Informationen
> enthalten. Sie ist ausschließlich für den Adressaten bestimmt. Wenn Sie
> nicht der beabsichtigte Adressat sind, möchten wir Sie hiermit darüber
> informieren, dass das Weiterleiten, Verteilen oder Kopieren dieser Mail
> nicht gestattet ist. Wenn Sie diese Mail irrtümlicherweise erhalten haben,
> informieren Sie uns bitte schnellstmöglich und löschen Sie bitte die Mail.
>
>
> -----Ursprüngliche Nachricht-----
> Von: Jonathan Rudenberg [mailto:jonat...@titanous.com]
> Gesendet: Dienstag, 8. August 2017 19:12
> An: Fiedler, Arno
> Cc: mozilla-dev-security-pol...@lists.mozilla.org
> Betreff: Re: Certificate issued by D-TRUST SSL Class 3 CA 1 2009 with
> short SerialNumber
>
>
> > On Aug 8, 2017, at 08:58, Fiedler, Arno via dev-security-policy <
> dev-security-policy@lists.mozilla.org> wrote:
> >
> > Dear Mozilla Security Policy Community,
> >
> > Thanks for the advice about the short serial numbers and apologies for
> the delayed response.
> >
> > Since 2016, all D-TRUST TLS certificates based on electronic Certificate
> Requests have a certificate serial number which includes 64 bits of entropy.
> >
> > Between 2012 and July 6th, 2017 we produced a small number of
> certificates with  paper-based Certificate Registration Requests using 64
> bits of entropy in the "DNqualifier" field instead of the serial number
> field.
> >
> > Since the 7th of July, 2017, all D-TRUST TLS-Certificates have 64 bits
> of entropy in the serial number.
> >
> > I hope this helps and please do not hesitate to contact us if there are
> any further questions.
>
> Hi Arno,
>
> It doesn’t look like this certificate has been revoked yet?
> https://crt.sh/?id=174827359&opt=cablint
>
> Can you explain why it hasn’t been revoked yet and when it will be?
>
> Thanks,
>
> Jonathan
> _______________________________________________
> dev-security-policy mailing list
> dev-security-policy@lists.mozilla.org
> https://lists.mozilla.org/listinfo/dev-security-policy
>
_______________________________________________
dev-security-policy mailing list
dev-security-policy@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-security-policy

Reply via email to