SECOM: Failed an annual CPS update of Cybertrust Japan (CTJ)
Cybertrust Japan (CTJ), a subordinate CA signed by Security Communication RootCA2 (SECOM), identified that its CPS annual update was overdue. The issue was discovered during review of a draft next CPS update (version 1.3) and CPs, and CTJ stated that the CPS last update was April 1, 2021 (version 1.2) and CPs last update was November 30, 2021. CTJ reported the incident to its Policy Authority (PA), informed SECOM Trust Systems, and submitted an incident report for SECOM’s review. CTJ stated that certificate issuance was not stopped because the issue did not result in misissuance of certificates. As remediation, CTJ strengthened annual assessment procedures by transferring management of periodic annual assessments to the PA’s task (with the PA developing and executing the plan) and reviewing schedule/status at monthly PA meetings; SECOM also began managing and checking subordinate CAs’ CPs/CPSes revision status and notifying them before exceeding renewal deadlines. In later comments, the CA team stated that the monthly PA review and SECOM’s constant checking were working properly and that no additional remediation steps were planned. The bug was resolved as FIXED.
- CTJ published CPS version 1.2 (CPS last update).
- CTJ published CPs with last update date of November 30, 2021.
- CTJ identified the overdue CPS annual update and began informing its Policy Authority and SECOM Trust Systems.
- CTJ completed CPS update (version 1.3).
- CTJ and SECOM provided remediation steps in comment #7 of the incident report.
- Mozilla indicated it would close the bug on or about July 15, 2022.
- Secom representative — Hisashi Kamo (SECOM) submitted an incident report stating CTJ identified the overdue annual CPS update and provided a timeline and remediation overview.
- Secom representative — Kamo asked for time to prepare section #7 of the incident report.
- Secom representative — Kamo provided remediation steps: CTJ strengthened annual assessment procedures by moving periodic annual assessment management to the PA task and SECOM began managing/checking subordinate CPs/CPSes revision status.
- Mozilla representative — Ben Wilson asked what other remediation steps, if any, were planned.
- Secom representative — Kamo stated the remediation was working properly and that no additional steps were planned.
- Secom representative — Kamo reiterated that monthly PA review at CTJ and SECOM’s checking were working properly and that there were no other remediation steps related to the bug.
- Mozilla representative — Ben Wilson said he would close the bug on or about Friday, 15-Jul-2022.