Do Son 
Taiwan Network Certification Co., Ltd. recently acknowledged a significant compliance defect within its public key infrastructure. Specifically, independent security researchers discovered insufficient randomness across multiple intermediate certificate serial numbers. Consequently, these digital credentials violate standard baseline requirements established by the CA/Browser Forum. In response, the organization scheduled an emergency TWCA certificate revocation window ending on November 6, 2026. Therefore, website administrators across Taiwan must replace active digital certificates immediately to avert browser connection warnings.
Serial Number Entropy Defects and Baseline Mandates
Industry standards have enforced rigorous entropy baselines for certificate authorities for a decade. Since 2016, CA/Browser Forum regulations require certificate serial numbers to incorporate at least sixty-four bits of cryptographically secure pseudorandom output. However, audit reviews revealed that ten out of twenty-four intermediate certificates issued beneath the TWCA root contain predictable sequential structures. For example, the affected serial numbers combine calendar timestamps, fixed organizational headers, sequential counters, and barely twenty-four bits of randomness.
The non-compliant credentials span diverse operational environments across the regional authority. Specifically, the affected assets include six intermediate TLS certificates, two cross-signed digital credentials, and two S/MIME authority certificates. Fortunately, the incident involves zero private key compromise. The foundational private keys governing root and intermediate signing modules remain entirely secure. Nevertheless, missing cryptographic entropy invalidates industry compliance mandates.
Revocation Deadlines and Public Incident Tracking
To restore baseline compliance, the certificate authority launched an immediate infrastructure overhaul. Starting at midnight on November 6, TWCA will revoke all non-compliant intermediate certificates alongside their downstream leaf certificates. Consequently, major desktop and mobile browsers will immediately flag untrusted connections for outdated websites. To assist affected customers, the company posted emergency reissuance guidance across its public portal.
Meanwhile, security investigators urged the authority to publish a thorough post-mortem analysis. In response, TWCA acknowledged the external bug report in an official Mozilla Bugzilla disclosure thread and initiated forensic reviews. Furthermore, the organization plans to release an exhaustive incident report before November 12. Until remediation concludes, Taiwanese web administrators must verify digital credentials to ensure uninterrupted visitor accessibility.
Support Our Threat Intelligence
Find our tech and OS security coverage helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
