SECOM cross-certificate issued without prior Chrome Root Program notification and approval; closure requested after approval received
SECOM reported that it issued a cross-certificate from Security Communication RootCA2 to SECOM TLS RSA Root CA 2024 without first completing the required Chrome Root Program notification and obtaining prior express approval. That cross-certificate extended Chrome Root Store trust to two pre-existing externally-operated JPRS subordinate CAs: JPRS DV RSA CA 2024 G1 and JPRS OV RSA CA 2024 G1. SECOM said it had contacted the Chrome Root Program before issuance, but it did not disclose that those JPRS subordinate CAs already existed beneath the subject CA or that the cross-certificate would extend trust to them. SECOM later submitted a retrospective notification on 2026-08-27, completed all listed corrective action items by 2026-09-15, and on 2026-10-16 received explicit approval from the Chrome Root Program for the notification. In its closure summary, SECOM said it identified no misissuance, validation issue, certificate profile issue, private key compromise, or other technical defect affecting subscriber certificates under the two subordinate CAs. SECOM requested closure after documenting the incident root cause, remediation, and completed preventive controls.
- SECOM issued a cross-certificate from Security Communication RootCA2 to SECOM TLS RSA Root CA 2024, extending trust to the pre-existing externally-operated JPRS subordinate CAs.
- SECOM opened a preliminary incident report about the missing prior notification and approval.
- SECOM submitted a retrospective Chrome Root Program notification form for the two affected JPRS RSA subordinate CAs.
- SECOM completed mandatory training and a tabletop exercise for CA administrators as part of its corrective actions.
- SECOM completed its assessment of alternatives to the externally-operated subordinate CA model, informed its Qualified Auditor, and reviewed corrective-action effectiveness.
- SECOM received explicit approval from the Chrome Root Program for the retrospective notification.
- Ml representative — SECOM filed a preliminary incident report explaining that it had not obtained prior Chrome Root Program notification and approval before issuing the cross-certificate.
- Ml representative — SECOM said it had submitted the Chrome Root Program Notification of CA Certificate Issuance form retrospectively for JPRS DV RSA CA 2024 G1 and JPRS OV RSA CA 2024 G1.
- Apple representative — Apple asked SECOM to answer the impact questions using subscriber certificates under each CA certificate in scope.
- Ml representative — SECOM provided subscriber certificate counts, said issuance had not been stopped, and said it had not identified technical defects affecting those subscriber certificates.
- Ml representative — SECOM posted the full incident report and attached a CSV of CA certificates.
- Ml representative — SECOM said it completed Action Item #5 and listed Action Item #6 as ongoing.
- Ml representative — SECOM said it completed Action Item #6 and documented its assessment, auditor discussion, and corrective-action review.
- Ml representative — SECOM said all action items were complete and it planned to request closure within one week.
- Ml representative — SECOM said it was not requesting closure yet because explicit approval from the Chrome Root Program had not yet been received.
- Ml representative — SECOM said it received explicit approval from the Chrome Root Program on 2026-10-16 and would post the closure summary separately.
- Ml representative — SECOM posted the report closure summary and requested closure of the incident.