SECOM self-reported issuance of five subordinate CA certificates without Apple prior approval; incident closed after remediation
SECOM reported that it issued five subordinate CA certificates to Cybertrust Japan Co., Ltd. without obtaining Apple’s prior approval, which was required for an externally operated subordinate CA. The issue was discovered by SECOM during an internal review prompted by Bug 2066068, and SECOM notified the Apple Root Program the same day it identified the non-compliance. Apple later told SECOM that the five subordinate CA certificates were mis-issued and that retrospective approval was not available. SECOM and Cybertrust Japan stopped end-entity issuance under the affected subordinate CAs, and SECOM revoked all five subordinate CA certificates on 2026-09-05. SECOM also updated the corresponding CCADB records and submitted reissuance requests to the Apple and Chrome Root Programs. On 2026-09-15, SECOM said it had completed all remaining action items, including a compliance gate, mandatory training, a tabletop exercise, and an effectiveness review. On 2026-09-24, SECOM posted a report closure summary and requested closure of the incident, and CCADB issued a final call for comments saying the case would be closed around 2026-10-01.
- SECOM issued five subordinate CA certificates to Cybertrust Japan without Apple prior approval.
- SECOM identified the non-compliance during an internal review.
- SECOM reported the issue to the Apple Root Program and stopped EE issuance under the affected subordinate CAs.
- SECOM completed revocation of the five affected subordinate CA certificates.
- SECOM completed the remaining corrective action items, including a compliance gate, training, and an effectiveness review.
- SECOM submitted a report closure summary and requested closure of the incident.
- Ml representative — SECOM filed a preliminary incident report describing the unauthorized issuance, the affected subordinate CAs, and the planned revocation.
- Ml representative — SECOM said it had suspended issuance under the affected subordinate CAs and temporarily extended issuance under two existing subordinate CAs during the transition.
- Ml representative — SECOM reported that it had completed revocation of all five subordinate CA certificates, updated CCADB records, and submitted reissuance requests.
- Mitaka representative — A commenter quoted SECOM’s revocation and reissuance update.
- Ml representative — SECOM said it completed action items #3, #4, and #5, including a compliance gate, mandatory training, and auditor notification.
- Ml representative — SECOM said all action items were complete and that it planned to request closure within one week if there were no outstanding comments or questions.
- Ml representative — SECOM posted a report closure summary and requested closure of the incident.
- CCADB representative — CCADB issued a final call for comments or questions and said the incident would be closed approximately on 2026-10-01.