SECOM/CTJ self-reported CP/CPS documentation discrepancy for OCSP responder certificate profiles
SECOM Trust Systems reported a self-identified compliance issue involving Cybertrust Japan (CTJ), a subordinate CA operator in its hierarchy. The issue was that CTJ’s CP/CPS Appendix B incorrectly stated that certain OCSP responder certificate profiles included the basicConstraints extension, while CTJ’s internal profile and the issued certificates did not. SECOM said the 24 affected OCSP responder certificates were issued on 2026-08-07, and that no subscriber certificates were affected. CTJ revised the CP/CPS on 2026-08-26 and reissued and replaced all 24 affected certificates by 2026-08-28. SECOM later filed the full incident report and then a closure summary stating that all mitigation and preventative action items had been completed. CCADB issued a final call for comments on 2026-09-13 and said the case would be closed around 2026-09-21 if there were no further questions.
- CTJ issued 24 OCSP responder certificates for four subordinate CAs.
- CTJ published a revised CP/CPS that incorrectly described the OCSP responder certificate profile.
- CTJ revised the CP/CPS and began reissuing the affected OCSP responder certificates.
- The 24 affected OCSP responder certificates were replaced.
- SECOM filed a closure summary stating that all action items were completed and requesting closure.
- Ml representative — SECOM opened a preliminary incident report describing the CP/CPS/profile mismatch and said it was self-reported by CTJ.
- CCADB representative — CCADB asked, "Should the subject line".
- Ml representative — SECOM said CTJ had published the revised CP/CPS and started reissuing the affected certificates.
- Ml representative — SECOM reported that reissuance and replacement of the 24 affected certificates had been completed.
- Ml representative — SECOM attached the CSV of affected OCSP responder certificates and filed the full incident report.
- Ml representative — SECOM posted a closure summary stating that the CP/CPS was corrected, the certificates were replaced, preventative controls were implemented, and closure was requested.
- CCADB representative — CCADB issued a final call for comments and said the incident report would be closed around 2026-09-21 if there were no further questions.