SECOM: FUJIFILM intermediate CA Certificate not listed in audit statement

SECOM Trust Systems disclosed that the FUJIFILM intermediate CA certificate was not included in the audit statement, raising compliance concerns. The issue was identified by SECOM itself, which led to the revocation of the intermediate CA certificate on March 9, 2021. SECOM acknowledged operational failures and a lack of awareness regarding the need for audits and name constraints. An incident report was subsequently provided detailing the timeline of actions taken and the reasons for the oversight, including corporate restructuring challenges. The case has been resolved with the certificate's revocation and commitments to improve compliance processes.

1. 2021-03-09 FUJIFILM intermediate CA certificate revoked

1. 2021-03-02 Mm representative — SECOM disclosed the FUJIFILM intermediate certificate not listed in the audit statement.
2. 2021-03-03 Secom representative — SECOM confirmed control of the private key for the intermediate certificate.
3. 2021-03-11 Mozilla representative — Mozilla requested an incident report regarding the compliance issue.
4. 2021-03-17 Secom representative — SECOM provided a detailed incident report addressing the oversight.
5. 2021-06-25 Mozilla representative — Mozilla indicated the issue would be considered in conjunction with broader compliance efforts.
6. 2021-10-26 Mozilla representative — Mozilla announced plans to close the bug.