SECOM Trust Systems: CrossTrust certificate OU longer than 64 characters

The case reports that a CrossTrust certificate issued by SECOM Trust Systems CO., LTD. contained an organizationalUnitName (OU) longer than 64 characters. The issue was noticed by Michel Le Bihan, who reported the problem in this Bugzilla bug and linked to the certificate on crt.sh. SECOM stated that it realized the incident via the Bugzilla email on 2019-03-05, and that the certificate in question had already expired by 2019-02-28, so it did not take action on that specific certificate. SECOM also stated that no further certificates with OU longer than 64 characters would be issued because its issuing system was configured accordingly, and it attributed the mistake to a bug in the OU input check system. SECOM reported that it strengthened DN checking during periodical maintenance in November 2018 to prevent recurrence. SECOM later confirmed that its investigation was completed and that no other certificates with the same problem were found, and a Fastly participant indicated that remediation was complete.

1. 2018-02-21 A CrossTrust certificate was issued with an organizationalUnitName longer than 64 characters.
2. 2019-02-28 The problematic certificate expired.
3. 2019-03-03 The issue was reported in the Mozilla CA Program Bugzilla by Michel Le Bihan.
4. 2019-03-05 SECOM Trust Systems realized the incident via the Bugzilla email.
5. 2019-03-28 SECOM Trust Systems completed its investigation and reported no other affected certificates were found.
6. 2019-08-11 A participant stated remediation was complete.

1. 2019-03-03 Lebihan representative — Reported that a CrossTrust certificate had an organizationalUnitName longer than 64 characters and provided a crt.sh link.
2. 2019-03-04 Fastly representative — Asked Kamo-san to provide an incident report per Mozilla’s incident response guidance link.
3. 2019-03-08 Secom representative — Submitted an incident report describing how SECOM became aware, the timeline, stated the certificate was already expired, explained the OU-check bug, and said the system was configured to prevent further issuance with OU > 64 characters.
4. 2019-03-28 Secom representative — Reported that the investigation was completed and that no other certificates were found with the OU > 64 characters issue.
5. 2019-08-11 Fastly representative — Noted that all questions had been answered and remediation was complete.