SECOM: Non conformant SCT Encoding Due to SCT Modification by Cybertrust Japan (CTJ)

Cybertrust Japan (CTJ), an externally operated subordinate CA of SECOM, reported a compliance issue involving TLS server certificates. The problem arose when SCTs returned by CT log servers contained non-empty values in the extensions field, but the issued certificates had an empty extensions field, leading to browser validation errors. This incident was identified as a violation of TLS Baseline Requirements Section 7.1.2.11.3. A total of 180 certificates were affected, with all valid certificates revoked by December 23, 2025. CTJ has since implemented several remediation measures, including system upgrades and enhanced monitoring processes to prevent recurrence.

1. 2025-12-04 CTJ updated its configuration to submit precertificates only to CT logs that return SCTs with empty extensions.
2. 2025-12-23 All affected certificates were revoked.

1. 2025-12-19 Ml representative — Reported the incident and described the compliance failure.
2. 2026-03-16 Ml representative — Confirmed completion of all action items related to the incident.
3. 2026-03-23 Ml representative — Provided a closure summary detailing the incident and remediation measures.