A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

By default, EJBCA generated certificates with 64-bit serial numbers, in keeping, it seemed, with an industry mandate that serial numbers contain 64 bits of output from a secure pseudo-random number generator. What that means is that, while the revocation and reissuance of between 1 million and 2 million certificates (at the time this post went live, researchers were still debating the number) is a major undertaking, there is virtually no security threat posed by the error. An Apple official said here that the total number of non-compliant certificates his company issued was about 878,000, although the number of certificates that were still valid, and not expired and not revoked as of last Thursday, was about 558,000.

Source: arstechnica.com