SECOM: Cybertrust Japan's CRL lacks the critical flag in the issuingDistributionPoint extension

On July 1, 2025, Cybertrust Japan received a notification regarding a compliance issue with the IssuingDistributionPoint extension in their CRLs, which was incorrectly marked as non-critical. This was a violation of the TLS Baseline Requirements. Following an internal investigation, Cybertrust Japan removed the extension from their CRL profiles on July 4, 2025, and implemented corrective actions including the use of a linting tool to validate CRLs before publication. A full incident report was prepared and all action items have been completed.

1. 2025-07-01 Cybertrust Japan received notification of CRL compliance issue.
2. 2025-07-04 Cybertrust Japan revised CRL profiles and removed the non-critical extension.