TWCA to Revoke Noncompliant Certificates After Serial Number Flaw

Taiwan’s TWCA Certificate Authority has acknowledged a compliance defect in its PKI after independent researchers found insufficient randomness in serial numbers across multiple intermediate certificates. The flaw means several TWCA-issued credentials fall short of the CA/Browser Forum baseline requirement of at least 64 bits of cryptographically secure pseudorandom output for serial numbers. The company says the affected certificates do not involve any private-key compromise.

In total, ten of twenty-four intermediate certificates under the TWCA root were flagged as non-compliant, including six intermediate TLS certificates, two cross-signed credentials, and two S/MIME authority certificates.

TWCA has announced an emergency certificate revocation window, with revocation starting from midnight on 6 November 2026 and extending to revoke all non-compliant intermediates and their downstream leaf certificates. This action is intended to restore baseline compliance and prevent untrusted-connection warnings in major browsers for affected sites. The firm has posted emergency reissuance guidance on its public portal to assist administrators.

Investigators have urged TWCA to publish a post-mortem, and TWCA acknowledged an external bug report in a Mozilla Bugzilla thread (id 2087236) and said forensic reviews are underway, with an exhaustive incident report planned before 12 November. Until remediation completes, Taiwanese web administrators must verify credentials to maintain site accessibility.