SECOM: Certificates Issued with lower case value in subject:countryName

SECOM Trust Systems reported an incident involving 16 TLS server certificates issued with a lowercase country code (C=jp) on May 9, 2024. The CA acknowledged that while this may not strictly violate the Baseline Requirements, it could be perceived as a misissuance. In response, SECOM revoked 140 certificates on May 24, 2024, and implemented a system change to ensure that future certificates will only use uppercase letters for the subject:countryName. The CA is also participating in discussions to clarify standards regarding country code formatting.

1. 2024-05-09 SECOM identified 16 TLS server certificates with lowercase country codes.
2. 2024-05-24 SECOM completed revocation of 140 certificates.
3. 2024-05-30 SECOM implemented a system change to enforce uppercase country codes.

1. 2024-05-14 Ml representative — SECOM reported the issuance of certificates with lowercase country codes and initiated the bug.
2. 2024-05-17 Community commenter — Suggested improvements in the certificate issuance process.
3. 2024-05-20 Ml representative — SECOM acknowledged the need for improvements in their systems.
4. 2024-06-12 Google representative — Inquired about tracking commitments made by SECOM.
5. 2024-06-14 Ml representative — SECOM confirmed plans to lead discussions on country code capitalization.
6. 2024-07-18 Mozilla representative — Scheduled to close the bug due to inactivity.