← SECOM Trust Systems CO., LTD. cases
Bugzilla #1548714
Certificate Misissuance
SECOM: "Default City" in Subject:localityName
RESOLVED
FIXED
SECOM Trust Systems CO., LTD.
AI Summary
SECOM Trust Systems CO., LTD. issued certificates containing 'Default City' in the localityName field, which is a violation of the Baseline Requirements. The issue was identified through a notification on the Mozilla dev-security-policy mailing list. SECOM acknowledged the problem, initiated revocation of the affected certificates, and implemented system improvements to prevent recurrence. The incident report detailed the timeline of actions taken, including the revocation of 24 certificates and the introduction of stricter validation processes. Despite these measures, two additional certificates with the same issue were later discovered and revoked.
Chronology
- Issue reported on misissued.com
- SECOM became aware of the issue
- Incident report submitted by SECOM
- Last problematic certificate revoked
- Two new problematic certificates discovered and revoked
Participants
Wayne Thayer
Hisashi Kamo
Ryan Sleevi
Jinta Nakamura
External References
Similar Local Cases
SECOM: Failure to disclose Unconstrained Intermediate within 7 Days
SECOM: Unqualified domain name in SAN
SECOM: Undisclosed intermediate certificates
SECOM: TSA Certs Issued from Root
SECOM: CrossTrust: OU > 64 characters
SECOM: Mis-issued EV Certificates
Kamu SM: "Some-State" in stateOrProvinceName
certSIGN: "Some-State" in stateOrProvinceName