SECOM: Cybertrust Japan's CRL lacks the critical flag in the issuingDistributionPoint extension

On July 1, 2025, Cybertrust Japan received a notification from a third party regarding a compliance issue with the IssuingDistributionPoint extension in their CRLs, which was incorrectly marked as non-critical. Following an internal investigation, Cybertrust Japan confirmed the error and took corrective action by removing the extension from their CRL profiles on July 4, 2025. The incident was documented, and a full report was prepared, detailing the root cause as a misunderstanding of the Baseline Requirements. Cybertrust Japan has since implemented a linting tool for CRLs and established a process for quarterly self-audits to prevent future occurrences. The case has been resolved, and all action items have been completed.

1. 2025-07-01 Cybertrust Japan received notification of a compliance issue with the IssuingDistributionPoint extension.
2. 2025-07-04 Cybertrust Japan revised its CRL profiles to remove the non-compliant extension.

1. 2025-07-04 Ml representative — Cybertrust Japan submitted a preliminary incident report regarding the CRL issue.
2. 2025-07-11 Ml representative — Cybertrust Japan indicated they were preparing a full incident report.
3. 2025-07-14 Ml representative — Cybertrust Japan submitted the full incident report detailing the compliance issue.
4. 2025-09-11 Ml representative — Cybertrust Japan provided a closure report confirming all action items were completed.