SECOM/CTJ: EV certificate mis-issued with incorrect Registration Number

The case reports that Cybertrust Japan (CTJ), which operates subordinate CAs signed by Security Communication RootCA2 (SECOM), mis-issued an EV certificate with an incorrect Registration Number included. CTJ stated that its validation team became aware when a secondary validation agent noticed a possibility of incorrect Registration Number during processing of a second EV certificate request, leading to re-checking and confirmation that the first certificate had been mis-issued. CTJ revoked the problematic certificate within 5 days of problem detection and issued corrected certificates with the correct Registration Number. CTJ later discovered additional mis-issued EV certificates from certificates issued in the past, bringing the total to seven mis-issued certificates, and reported that all additional mis-issued certificates were revoked by December 23, 2022. CTJ implemented a temporary remediation by changing the Registration Number validation procedure to use a validation support tool, and stated that it completed ultimate remediation by implementing technical control on the RA system on January 19, 2023. Mozilla asked what additional remediation items remained, and CTJ responded that there would be no additional remediation items because ultimate remediation was completed.

1. 2022-12-12 CTJ mis-issued an EV certificate with an incorrect Registration Number during secondary validation.
2. 2022-12-13 CTJ revoked the problematic EV certificate within 5 days of detection.
3. 2022-12-23 CTJ completed revocation of all additional mis-issued EV certificates and confirmed CRL/OCSP listing.
4. 2023-01-19 CTJ completed ultimate remediation by implementing technical control on the RA system.

1. 2022-12-15 Ml representative — SECOM/CTJ posted an incident report describing how the EV mis-issuance was discovered, the revocation timing, and a timeline of actions including reissuance with the correct Registration Number.
2. 2022-12-20 Secom representative — A follow-up report attachment was created.
3. 2022-12-20 Ml representative — SECOM/CTJ provided an update report through 2022/12/19, including discovery of additional mis-issued certificates and implementation of a temporary support tool.
4. 2022-12-23 Secom representative — SECOM/CTJ reported completion of inspection (total seven mis-issued certificates) and that additional mis-issued certificates were revoked by December 23, 2022, with CRL/OCSP confirmation.
5. 2023-01-23 Ml representative — SECOM/CTJ reported that technical control on the RA system was completed on January 19, 2023 and tested successfully.
6. 2023-01-23 Mozilla representative — Mozilla asked what additional remediation items remained to be done.
7. 2023-01-26 Ml representative — SECOM/CTJ stated there would be no additional remediation items because ultimate remediation was completed.
8. 2023-01-26 Mozilla representative — Mozilla indicated it would consider closing the case on Wed 1-Feb-2023.