SECOM: failure to revoke certificates with underscore DNS names

SECOM failed to revoke certificates containing DNS names with underscores by the required deadline of 2019-01-15 (CABF ballot SC12). Jonathan Rudenberg notified SECOM via their problem reporting address on 2019-01-29, and SECOM confirmed the certificates were revoked the same day. The thread includes SECOM’s incident report describing when SECOM became aware of the problem and a timeline of actions, stating that seven certificates were revoked on the day of the notice. SECOM also stated it had been aware of the 15-January deadline, but that certificates for confirmation of CA system configuration were recorded in a separate database, which prevented SECOM from recognizing and targeting them during investigation. SECOM said it implemented a system to check that DNS names do not include underscores and to prevent operational mistakes, and later stated that remediation appeared complete. The bug is marked RESOLVED with resolution FIXED.

1. 2018-09-10 SECOM issued two certificates later identified as containing DNS names with underscores.
2. 2018-09-12 SECOM issued four certificates later identified as containing DNS names with underscores.
3. 2018-10-03 SECOM issued one certificate later identified as containing DNS names with underscores.
4. 2019-01-15 The required deadline passed for revoking certificates containing underscore characters in DNS names.
5. 2019-01-29 SECOM was notified and confirmed revocation of the identified certificates the same day.
6. 2019-02-21 SECOM implemented a system to check for underscores in DNS names and prevent operational mistakes.

1. 2019-02-03 Titanous representative — Reported that SECOM failed to revoke underscore-containing DNS name certificates by 2019-01-15 and stated SECOM was notified on 2019-01-29 and confirmed revocation that day, with crt.sh links.
2. 2019-02-03 Fastly representative — Requested an incident report and asked for an explanation if revocation was intentionally delayed.
3. 2019-02-08 Secom representative — Said SECOM was preparing an incident report and would post it the next week.
4. 2019-02-15 Secom representative — Provided an incident report with a timeline, stated the certificates were revoked on the day of notice, and explained the issue with certificates being recorded in a separate database.
5. 2019-02-20 Fastly representative — Asked whether SECOM was aware of the 2019-01-15 deadline and, if so, why the certificates were not detected.
6. 2019-02-20 Secom representative — Confirmed awareness of the deadline and explained that separate database records prevented targeting during investigation; said administrators were notified to check going forward.
7. 2019-02-21 Fastly representative — Asked when SECOM expected implementation of a system to check DNS names for underscores and prevent operational mistakes.
8. 2019-02-21 Secom representative — Stated SECOM implemented the changes that day.
9. 2019-02-21 Fastly representative — Commented that it appears remediation is complete.