SECOM: Issuance of TLS server certificates using keys previously compromised

SECOM Trust Systems faced a mis-issuance of TLS server certificates using previously compromised keys, violating Baseline Requirements. Upon notification on November 13, 2024, SECOM revoked nine valid certificates within 24 hours. The incident was attributed to a malfunction in their public key check mechanism, which allowed the same key to be reused with different subject DNs. SECOM has since updated their systems to prevent such occurrences and plans to enhance their mechanisms further by January 31, 2025.

1. 2024-11-13 Informed about mis-issuance of TLS server certificates.
2. 2024-11-14 Revoked nine valid TLS server certificates.
3. 2024-11-22 Planned to enhance mechanisms to prevent key reuse.
4. 2024-12-25 Completed updates to prevent reuse of previously used public keys.