Taiwan's Ministry of Digital Affairs (MODA) has spent a week on a problem that most citizens will never see. TWCA is the certificate authority behind the TLS certificates on government websites. It issued certificates whose serial numbers were far less random than the industry rulebook requires. MODA's response was fast and, on the available evidence, proportionate. It also shows how fragile centralised public-key infrastructure can be.
What happened
According to MODA's 2 November press release, a report on Mozilla's Bugzilla on 30 October said some TWCA certificates had insufficient serial-number entropy. TWCA used 128-bit serial numbers. Only the first and last 12 bits were random, and the middle was fixed. That leaves about 24 effective random bits.
The CA/Browser Forum's Ballot 164 has required at least 64 bits of CSPRNG output in serial numbers since 30 September 2016. The Baseline Requirements treat this as a defence against hash-collision attacks on certificate signatures.
The incident covers 962 government agencies and 9,772 website certificates that MODA procured for them. MODA says TWCA finished reissuing all of them on 1 November and emailed the files to each agency's contact. By the evening of 2 November, 926 had been installed. Agencies were asked to finish by 6 November to avoid browser security warnings. MODA says no concrete security harm has been established. The release does not say whether every certificate was installed by the deadline, and we have not seen a confirmation. Visitors to any site that missed it may still see warnings.
A separate Bugzilla report, bug 2087918, says TWCA's subscriber certificates carry only 63 bits of CSPRNG output rather than 64, because the top bit is always zero. That is a related but different failure. TWCA has said it will consolidate the full report in the other bug, and we have not verified what that report says.
The strongest case for a hard line
The case for strictness is real. A certificate authority is trusted precisely because it follows rules that outsiders cannot check in real time. Serial-number entropy is a minor-looking control, but it was written into the rules after researchers showed that predictable serials made collision attacks practical. A CA that ships 24 effective bits has not met the standard, whatever the practical risk is today. Taiwan's government paid for these certificates, so MODA's decision to commission an independent test of TWCA, investigate breach of contract and seek fines and damages is reasonable procurement discipline.
Where proportionality matters
The response should still match the risk. The flaw makes collision attacks easier in theory. Exploiting it requires an attacker who can get a CA to sign a crafted request and who can also find a collision in the signature hash. MODA's statement that no harm has been established fits that. Browser warnings are the main cost here, not a breach.
That is the point in the response worth defending. MODA did not wait for a lengthy investigation. It ordered new certificates within days, and TWCA delivered them in roughly two. It also activated a contact process with agency IT managers. This is how a ministry should treat a compliance defect: fix the artefact, set a short public deadline, then investigate the cause.
The risk is a regulatory reflex that treats every standards deviation as a crisis. That reflex could push agencies towards blunt measures, such as mandatory shorter lifetimes without automation, or a ban on commercial CAs. Both would cost more than the flaw did.
The structural lesson: manual reissue does not scale
The harder lesson is the mechanism. Reissuing 9,772 certificates required emailing files to 962 agency contacts and waiting for people to install them. On the second evening, 926 had been replaced, under 10%. That is slow for a deadline set days earlier, and it shows what a manual process costs.
This matters more as certificate lifetimes fall across the industry. Short-lived certificates only work when issuance and renewal are automated. A government that depends on hand-installed certificates will find every future incident painful. It will also find ordinary renewals painful.
Taiwan's structure adds a second concentration risk. MODA procures certificates centrally from a single CA for almost 1,000 agencies. Central procurement brings economies of scale and consistent policy. It also means one CA's defect lands on every agency at once. A defect in the CA-certificate generation code, which is what the consolidated bug concerns, is the kind of failure that cuts across customers.
What MODA should do next
- Publish the completion data. Say how many of the 9,772 certificates were installed by 6 November and how many sites showed warnings. Without that, nobody can judge whether the order worked.
- Require ACME-style automated issuance for government TLS, so a future reissue is a configuration change rather than an email campaign.
- Allow a second CA for fallback. Taiwan's dual-certificate scheme for government websites already points that way. Diversity in issuers limits how far one CA's bug can spread.
- Publish the independent test results. Transparency about the test of TWCA would help other governments and the browser root programmes, which decide whether a CA stays trusted.
MODA's quick response deserves credit, and so does its early public disclosure. The real test is whether it turns one emergency into automation and supplier diversity. Without those, the next serial-number flaw will bring the same deadline and the same email campaign.