SECOM: Failure to disclose Unconstrained Intermediate within 7 Days

SECOM Trust Systems CO., LTD. failed to disclose an unconstrained intermediate certificate within the required 7-day timeframe, as mandated by Mozilla's policy. The issue was identified by an external party, leading to a request for an incident report. SECOM acknowledged the oversight, confirmed that the intermediate certificate did not meet the necessary technical constraints, and subsequently revoked the affected certificates. The CA committed to implementing procedural changes to prevent future occurrences and submitted an incident report detailing the timeline and corrective actions taken.

1. 2019-07-04 SECOM was notified of the failure to disclose an unconstrained intermediate certificate.
2. 2019-07-23 SECOM revoked the affected intermediate and server certificates.

1. 2019-07-04 Community commenter — The following certificate has been issued and is not disclosed within CCADB.
2. 2019-07-05 Secom representative — We are now summarizing the detailed information regarding this issue.
3. 2019-07-09 Community commenter — The certificate is required to be disclosed and audited due to insufficient constraints.
4. 2019-07-12 Secom representative — We found that the control of the name constraints is insufficient.
5. 2019-07-23 Secom representative — We have revoked this certificate and signing CA certificate.
6. 2019-09-15 Fastly representative — It appears that all questions have been answered and remediation is complete.