Hello Jonathan, the certificate has 64 bits of entropy in the "DNqualifier" field instead of the serial number field.
Since 2012 we used this way of adding random bits to certificates to mitigate preimage attacks From a security perspective the amount of Entropy in the certificate should be reasonable. Do you see a security need for revoking the certificate? Viele Grüße Arno Fiedler Standardization & Consulting Bundesdruckerei GmbH Kommandantenstraße 18 · 10969 Berlin · Deutschland Tel. : + 49 30 25 98 - 3009 Mobil: + 49 172 3053272 arno.fied...@bdr.de · www.bundesdruckerei.de Sitz der Gesellschaft: Berlin · Handelsregister: AG Berlin-Charlottenburg HRB 80443. USt.-IdNr.: DE 813210005 Aufsichtsratsvorsitzender: Willi Berchtold Geschäftsführer: Ulrich Hamann (Vorsitzender), Christian Helfrich This message is intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, we hereby give notice that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this message in error, please delete the message and notify us immediately. Diese Nachricht kann vertrauliche und gesetzlich geschützte Informationen enthalten. Sie ist ausschließlich für den Adressaten bestimmt. Wenn Sie nicht der beabsichtigte Adressat sind, möchten wir Sie hiermit darüber informieren, dass das Weiterleiten, Verteilen oder Kopieren dieser Mail nicht gestattet ist. Wenn Sie diese Mail irrtümlicherweise erhalten haben, informieren Sie uns bitte schnellstmöglich und löschen Sie bitte die Mail. -----Ursprüngliche Nachricht----- Von: Jonathan Rudenberg [mailto:jonat...@titanous.com] Gesendet: Dienstag, 8. August 2017 19:12 An: Fiedler, Arno Cc: mozilla-dev-security-pol...@lists.mozilla.org Betreff: Re: Certificate issued by D-TRUST SSL Class 3 CA 1 2009 with short SerialNumber > On Aug 8, 2017, at 08:58, Fiedler, Arno via dev-security-policy > <dev-security-policy@lists.mozilla.org> wrote: > > Dear Mozilla Security Policy Community, > > Thanks for the advice about the short serial numbers and apologies for the > delayed response. > > Since 2016, all D-TRUST TLS certificates based on electronic Certificate > Requests have a certificate serial number which includes 64 bits of entropy. > > Between 2012 and July 6th, 2017 we produced a small number of certificates > with paper-based Certificate Registration Requests using 64 bits of entropy > in the "DNqualifier" field instead of the serial number field. > > Since the 7th of July, 2017, all D-TRUST TLS-Certificates have 64 bits of > entropy in the serial number. > > I hope this helps and please do not hesitate to contact us if there are any > further questions. Hi Arno, It doesn’t look like this certificate has been revoked yet? https://crt.sh/?id=174827359&opt=cablint Can you explain why it hasn’t been revoked yet and when it will be? Thanks, Jonathan _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
