Even root CAs have been known to not comply with the randomized serial number requirement occasionally, see [1] for a recent example, with the most recent (SHA-

Even root CAs have been known to not comply with the randomized serial number requirement occasionally, see [1] for a recent example, with the most recent (SHA-1) certificate being issued in August of last year. [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1267332#c5 https://bugzilla.mozilla.org/show_bug.cgi?id=1267332#c5