SECOM: certificate for which “OU=-”

SECOM reported an issue involving a certificate containing “OU=-”. SECOM stated that it discovered the problem certificate during an irregular inspection after the certificate was listed at https://misissued.com, and that it contacted the customer for revocation on 2019-02-06. SECOM said the certificate was revoked on 2019-02-13, and later described that the customer agreed to the revocation and revoked the certificate after reissuing it (with the customer agreement dated 2019-02-13 and revocation after reissuing dated 2019-02-13/2019-02-15 in the narrative). SECOM attributed the underlying cause to a bug in the check system for the input data for “OU”, and said plans were underway to upgrade the system as a countermeasure. In response to requests for more detail, SECOM provided a timeline and additional explanation, including that BR Version 1.6.5 explicitly defines “OU=-” as problematic and that it planned to update its improvement measure by the end of June. SECOM later stated the measure was completed on 2019-06-23, and a participant from Fastly indicated that remediation was complete and that all questions had been answered.

1. 2016-06-01 SECOM issued the certificate containing “OU=-”.
2. 2019-02-06 SECOM discovered the problem certificate during an irregular inspection and contacted the customer for revocation.
3. 2019-02-13 The problem certificate was revoked after the customer agreed to the revocation and reissued/revoked as described by SECOM.
4. 2019-06-23 SECOM completed the planned improvement measure/countermeasure update.

1. 2019-04-16 Secom representative — SECOM submitted an incident report stating it investigated a certificate with “OU=-”, contacted the customer for revocation on 2019-02-06, and revoked the certificate on 2019-02-13, citing a bug in the “OU” input check system and planning a system upgrade.
2. 2019-04-16 Community commenter — Ryan Sleevi questioned whether the revocation timing met Baseline Requirements and requested more details about why the certificate was examined, the specific cause, customer communication, and concrete next steps.
3. 2019-04-19 Secom representative — SECOM thanked Ryan and said it was preparing answers and would post them the following week.
4. 2019-04-26 Secom representative — SECOM responded with additional timeline details, including that it found the certificate via https://misissued.com, explained its interpretation of BR version differences around “OU=-”, and stated it would update its improvement measure by the end of June.
5. 2019-07-04 Community commenter — Ryan noted there had been no update after May 7 regarding a concrete timeline for proposed steps.
6. 2019-07-05 Secom representative — SECOM apologized for the delay and stated the improvement measure was completed on June 23 and that it would ensure timely reporting going forward.
7. 2019-08-11 Fastly representative — Fastly stated it appeared all questions had been answered and remediation was complete.