SECOM: "Default City" in Subject:localityName

SECOM Trust Systems CO., LTD. identified a compliance issue where 24 certificates contained 'Default City' in the localityName field, which was not validated according to the Baseline Requirements. The issue was discovered after a notification from the mozilla.dev-security-policy mailing list on May 7, 2019. SECOM initiated revocation of the affected certificates, completing the process by May 16, 2019. They also implemented system modifications to prevent future occurrences of this issue, including prohibiting the issuance of certificates with 'Default City' in the localityName field. An incident report detailing the actions taken was provided to Mozilla.

1. 2019-05-02 List of SECOM certificates with 'Default City' published.
2. 2019-05-07 SECOM became aware of the issue and began revocation.
3. 2019-05-10 20 out of 24 problematic certificates were revoked.
4. 2019-05-16 Final problematic certificate was revoked.
5. 2019-06-10 System improvements completed to prevent future issues.

1. 2019-05-02 Fastly representative — Reported SECOM certificates with 'Default City' in localityName.
2. 2019-05-07 Secom representative — SECOM acknowledged the issue and began revocation.
3. 2019-05-10 Secom representative — Provided incident report detailing actions taken.
4. 2019-05-17 Secom representative — Confirmed completion of revocation of all problematic certificates.
5. 2019-06-28 Secom representative — Reported completion of system modifications to prevent future issues.