SECOM: Unqualified domain name in SAN

SECOM Trust Systems CO., LTD. disclosed a compliance issue involving a certificate that included an unqualified domain name 'sgnwffw001' in the Subject Alternative Name (SAN) extension. The issue was identified by a third party, leading SECOM to revoke the certificate on March 2, 2021. SECOM provided a detailed incident report outlining their response, including a timeline of actions taken to address the problem and prevent future occurrences. They implemented measures to restrict the issuance of certificates to only those domains that are permitted, and they have since updated their systems to ensure compliance with the Baseline Requirements.

1. 2021-03-02 SECOM revoked the certificate with the unqualified domain name.

1. 2021-03-01 Fozzie representative — SECOM has issued a certificate with an unqualified domain name of 'sgnwffw001' in the SAN extension.
2. 2021-03-02 Secom representative — The certificate you pointed out was revoked.
3. 2021-03-09 Secom representative — We became aware of the problem upon receiving the email notification.
4. 2021-04-07 Secom representative — We have started the process to revoke EE certificates in which FUJIFILM CA was not 'Technically Constrained Sub-CA'.
5. 2021-07-09 Secom representative — All work to improve domain validation and check CAA records has been completed.