SECOM: Invalid stateOrProvinceName

SECOM Trust Systems disclosed an incident involving TLS server certificates issued via ACME from its subordinate CAs, 'NII Open Domain CA - G7 RSA' and 'NII Open Domain CA - G7 ECC', which violated Baseline Requirements due to malformed 'stateOrProvinceName' values. The issue was discovered during a customer meeting on December 8, 2025, leading to the suspension of ACME issuance. A total of 167 affected certificates were identified and subsequently revoked by December 10, 2025. Remediation actions included updating the application to prevent future misissuance and implementing an automatic Subject field validation process. All action items have been completed, and a closure report has been prepared.

1. 2025-10-17 First non-compliant certificate issued.
2. 2025-12-08 Issue discovered during a customer meeting.
3. 2025-12-10 All affected certificates revoked.
4. 2026-01-27 Automatic Subject field validation completed.
5. 2026-02-12 Incident report closure requested.

1. 2025-12-08 Ml representative — Incident discovered during a customer meeting.
2. 2025-12-10 Ml representative — All affected certificates revoked.
3. 2026-01-28 Ml representative — Automatic Subject field validation completed.
4. 2026-02-04 Ml representative — Closure report prepared.
5. 2026-02-05 CCADB representative — Final call for comments on the incident report.