SECOM: certificate for .test TLD (incident report and remediation)

This case concerns a SECOM-issued certificate containing a DNS SAN for a reserved .test TLD (test20180323.secom.test). The bug reporter stated that SECOM issued and then revoked a precertificate on 2018-03-18, and noted that .test is reserved so SECOM could not have validated the SAN; they also reported an invalid country code in the subject (UK) and that the CN was not present in the SANs. A Fastly representative asked SECOM to provide an incident report and explain why one was not filed at the time, referencing Mozilla’s incident response guidance. SECOM responded that it became aware of the issue via Bugzilla on 2019-02-02 and provided an incident report describing the timeline, the problematic certificate details, and why the mistakes occurred during CA system configuration. SECOM stated it implemented permanent actions including enhancements to its review process and operation confirmation, and planned a system enhancement to prevent operational mistakes. SECOM later reported that the implementation was completed on March 25.

1. 2018-03-18 SECOM issued and then revoked a precertificate containing a DNS SAN under the reserved .test TLD.
2. 2019-02-02 SECOM became aware of the issue via the Bugzilla report.
3. 2019-02-15 SECOM provided an incident report with remediation steps and timelines.
4. 2019-03-25 SECOM reported implementation of the planned system enhancement.

1. 2019-02-01 Mm representative — Reported that SECOM issued and revoked a precertificate on 2018-03-18 with a DNS SAN for test20180323.secom.test and noted additional certificate issues (invalid country code and CN not in SANs), linking to crt.sh.
2. 2019-02-02 Fastly representative — Requested an incident report and asked SECOM to explain why one was not filed and how SECOM would ensure prompt incident reporting in the future.
3. 2019-02-08 Secom representative — Said SECOM was preparing an incident report and would post it the following week.
4. 2019-02-15 Secom representative — Provided an incident report describing how SECOM became aware (Bugzilla), the timeline, the problematic certificate characteristics, the cause during CA system configuration, and permanent actions to prevent recurrence.
5. 2019-02-15 Fastly representative — Asked how domain control was validated on the certificate.
6. 2019-02-20 Secom representative — Explained that the certificate was issued during CA system configuration, that domain control was manually validated at the time, and that it is now systematically validated.
7. 2019-02-20 Fastly representative — Asked when SECOM expected the planned system enhancement to be implemented.
8. 2019-02-21 Secom representative — Stated SECOM planned to implement the changes by the end of March.
9. 2019-03-29 Secom representative — Reported that implementation was done on March 25.