for Web SR Certificate Policy Version 2.50 2017 5 23
1.00 2008/02/25 1.10 2008/09/19 1.20 2009/05/13 5 1.30 2012/02/15 5.6 CA 1.40 2012/11/09 OCSP SubjectAltName 2.00 2013/12/02 SECOM Passport for Web SR2.0 CA SECOM Passport for Web SR CA CA SECOM Passport for Web SR3.0 CA 2.10 2014/01/15 2.20 2014/09/25 Basic Constraints 3 2.30 2015/04/15 CAA 2.40 2015/12/25 2.50 2017/05/23 SECOM Passport for Web SR2.0 CA I
1.... 1 1.1... 1 1.2... 2 1.3 PKI... 2 1.3.1... 2 1.3.1.1 IA... 2 1.3.1.2 RA... 2 1.3.2... 2 1.3.3... 3 1.4... 3 1.4.1... 3 1.4.2... 3 1.5... 3 1.5.1... 3 1.5.2... 3 1.5.3... 3 1.5.4... 3 1.6... 4 2.... 8 2.1... 8 2.2... 8 2.3... 8 2.4... 8 3.... 9 3.1... 9 3.1.1... 9 3.1.2... 9 3.1.3... 9 3.1.4... 9 3.1.5... 9 3.1.6... 9 3.2... 10 3.2.1... 10 3.2.2... 10 II
3.2.3... 10 3.2.4... 10 3.2.5... 10 3.2.6... 10 3.2.7... 11 3.3... 11 3.3.1... 11 3.3.2... 11 3.4... 11 4.... 12 4.1... 12 4.1.1... 12 4.1.2... 12 4.2... 12 4.2.1... 12 4.2.2... 12 4.2.3... 12 4.3... 13 4.3.1... 13 4.3.2... 13 4.4... 13 4.4.1... 13 4.4.2... 13 4.4.3... 13 4.5... 13 4.5.1... 13 4.5.2... 13 4.6... 14 4.6.1... 14 4.6.2... 14 4.6.3... 14 4.6.4... 14 4.6.5... 14 4.6.6... 14 4.6.7... 14 4.7... 14 III
4.7.1... 14 4.7.2... 15 4.7.3... 15 4.7.4... 15 4.7.5... 15 4.7.6... 15 4.7.7... 15 4.8... 15 4.8.1... 15 4.8.2... 15 4.8.3... 15 4.8.4... 15 4.8.5... 16 4.8.6... 16 4.8.7... 16 4.9... 16 4.9.1... 16 4.9.2... 16 4.9.3... 16 4.9.4... 17 4.9.5... 17 4.9.6... 17 4.9.7... 17 4.9.8... 17 4.9.9 /... 17 4.9.10 /... 17 4.9.11... 17 4.9.12... 18 4.9.13... 18 4.9.14... 18 4.9.15... 18 4.9.16... 18 4.10... 18 4.10.1... 18 4.10.2... 18 4.10.3... 18 IV
4.11... 18 4.12... 18 4.12.1... 19 4.12.2... 19 5.... 20 5.1... 20 5.1.1... 20 5.1.2... 20 5.1.3... 20 5.1.4... 20 5.1.5... 20 5.1.6... 20 5.1.7... 20 5.1.8... 20 5.2... 20 5.2.1... 20 5.2.2... 20 5.2.3... 21 5.2.4... 21 5.3... 21 5.3.1... 21 5.3.2... 21 5.3.3... 21 5.3.4... 21 5.3.5... 21 5.3.6... 21 5.3.7... 21 5.3.8... 21 5.4... 22 5.4.1... 22 5.4.2... 22 5.4.3... 22 5.4.4... 22 5.4.5... 22 5.4.6... 22 5.4.7... 22 V
5.4.8... 22 5.5... 22 5.5.1... 22 5.5.2... 23 5.5.3... 23 5.5.4... 23 5.5.5... 23 5.5.6... 23 5.5.7... 23 5.6... 23 5.7... 23 5.7.1... 24 5.7.2... 24 5.7.3... 24 5.7.4... 24 5.8... 24 6.... 25 6.1... 25 6.1.1... 25 6.1.2... 25 6.1.3... 25 6.1.4 CA... 25 6.1.5... 25 6.1.6... 25 6.1.7... 26 6.2... 26 6.2.1... 26 6.2.2... 26 6.2.3... 26 6.2.4... 26 6.2.5... 27 6.2.6... 27 6.2.7... 27 6.2.8... 27 6.2.9... 27 6.2.10... 27 VI
6.2.11... 27 6.3... 27 6.3.1... 28 6.3.2... 28 6.4... 28 6.4.1... 28 6.4.2... 28 6.4.3... 28 6.5... 28 6.5.1... 28 6.5.2... 28 6.6... 28 6.6.1... 28 6.6.2... 29 6.6.3... 29 6.7... 29 6.8... 29 7. OCSP... 30 7.1... 30 7.2 CRL... 32 7.3 OCSP... 32 7.3.1... 33 7.3.2 OCSP... 33 8.... 34 8.1... 34 8.2... 34 8.3... 34 8.4... 34 8.5... 34 8.6... 34 9.... 35 9.1... 35 9.2... 35 9.3... 35 9.3.1... 35 9.3.2... 35 VII
9.3.3... 35 9.4... 35 9.5... 35 9.6... 35 9.6.1... 35 9.6.1.1 IA... 35 9.6.1.2 RA... 36 9.6.2... 36 9.6.3... 36 9.6.4... 36 9.7... 36 9.8... 37 9.9... 37 9.10... 37 9.10.1... 37 9.10.2... 37 9.10.3... 38 9.11... 38 9.12... 38 9.12.1... 38 9.12.2... 38 9.12.3... 38 9.13... 38 9.14... 38 9.15... 38 9.16... 39 9.16.1... 39 9.16.2... 39 9.16.3... 39 9.16.4... 39 9.17... 39 VIII
1. 1.1 for Web SR CP SECOM Passport for Web SR 3.0 CA CA CA CPS SECOM Passport for Web SR 3.0 CA Security Communication RootCA2 SECOM Passport for Web SR 3.0 CA 6 1 2 3 CA for Web SR CA CP CP CPS CA https://www.cabforum.org/ca/ Browser Forum Baseline Requirements CP CP CPS CP CPS CP CA CP IETF RFC3647 Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework P-1
1.2 CP for Web SR CP 1.2-1 OID CP OID CP 1.2-1 OID CP OID SECOM Passport for Web SR 3.0 CA sha256 1.2.392.200091.100.751.1 CP CPS OID 1.2-2 OID CPS CPS 1.2-2 OID CPS OID 1.2.392.200091.100.401.1 1.3 PKI 1.3.1 CA Certification Authority IA RA CA 1.3.1.1 IA IA CRL Certificate Revocation List OCSP Online Certificate Status Protocol CA IA 1.3.1.2 RA RA 1.3.2 P-2
1.3.3 Web CP CPS 1.4 1.4.1 CA 1.4.2 CA 1.5 1.5.1 CP 1.5.2 CP CA 112-0015 2-7-8 ra-support@secom.co.jp 1.5.3 CP 1.5.4 CP P-3
1.6 CA CA CRL P-4
A Z CA Certification Authority CA CAA (Certificate Authority Authorization) DNS CA/Browser Forum CP Certificate Policy CA CPS Certification Practices Statement CA CA CRL Certificate Revocation List FIPS140-2 NIST National Institute of Standards and Technology 4 IA Issuing Authority CA CA P-5
OID Object Identifier OCSP Online Certificate Status Protocol PKI Public Key Infrastructure RA Registration Authority CA CA RFC3647 Request For Comments 3647 IETF The Internet Engineering Task Force CP/CPS RSA SHA-1 Secure Hash Algorithm 1 160 SHA-256 Secure Hash Algorithm 256 256 WebTrust for CA P-6
AICPACICA WebTrust for Baseline Requirements AICPACICA SSL P-7
2. 2.1 CRL 24 365 24 365 OCSP OCSP 2.2 CRL CA CP CPS CA OCSP 2.3 CP CPS CRL CP CRL 2.4 HTTP HyperText Transfer Protocol HTTPS HTTP SSL Web P-8
3. 3.1 3.1.1 CA X.500 DN Distinguished Name CA 1. C JP 2. O 3. OU OU 4. CN CA Web 3.1.2 CA CA Web DNS 3.1.3 CA 3.1.4 X.500 3.1.5 CA (DN) Web 3.1.6 P-9
3.2 3.2.1 Certificate Signing Request CSR CSR 3.2.2 3.2.3 3.2.4 3.2.5 CP 3.2.2. 3.2.3. 3.1.1 3.2.6 P-10
CA Security Communication RootCA2 3.2.7 WHOIS WHOIS 3.3 3.3.1 3.2 3.3.2 3.2 3.4 P-11
4. 4.1 4.1.1 [ for Web SR] 4.1.2 CP CA 4.2 4.2.1 CP 3.2 CAA (Certificate Authority Authorization) 4.2.2 4.2.3 P-12
4.3 4.3.1 4.3.2 CA 4.4 4.4.1 1 4.4.2 CA 4.4.3 4.5 4.5.1 CA 4.5.2 P-13
CP CPS CA CA 4.6 CA 4.6.1 4.6.2 4.6.3 4.6.4 4.6.5 4.6.6 4.6.7 4.7 4.7.1 90 60 P-14
4.7.2 4.1.1. 4.7.3 4.3.1. 4.7.4 4.3.2. 4.7.5 4.4.1. 4.7.6 4.4.2. 4.7.7 4.4.3. 4.8 CA 4.8.1 4.8.2 4.8.3 4.8.4 P-15
4.8.5 4.8.6 4.8.7 4.9 4.9.1 CP CPS CA 4.9.2 4.9.3 P-16
4.9.4 4.9.5 CRL 4.9.6 CA CRL URL OCSP URL CRL OCSP Web CRL CRL OCSP 4.9.7 CRL 24 CRL 4.9.8 CA CRL 4.9.9 / OCSP 24 OCSP 4.9.10 / CRL OCSP 4.9.11 P-17
4.9.12 4.9.13 CA 4.9.14 4.9.15 4.9.16 4.10 4.10.1 OCSP 4.10.2 CA 24 365 OCSP OCSP 4.10.3 4.11 4.12 P-18
4.12.1 CA 4.12.2 P-19
5. 5.1 5.1.1 5.1.2 5.1.3 5.1.4 5.1.5 5.1.6 5.1.7 5.1.8 5.2 5.2.1 5.2.2 P-20
5.2.3 5.2.4 5.3 5.3.1 5.3.2 5.3.3 5.3.4 5.3.5 5.3.6 5.3.7 5.3.8 P-21
5.4 5.4.1 5.4.2 5.4.3 5.4.4 5.4.5 5.4.6 5.4.7 5.4.8 5.5 5.5.1 CPS 5.4.1. CA CRL CRL CPS CPS P-22
OCSP 5.5.2 5 5.5.3 5.5.4 CRL CA 5.5.5 NTP Network Time Protocol CA CA 5.5.6 CA 5.5.7 5.6 CA CA CA CA 20 5.7 P-23
5.7.1 CA CA 5.7.2 CA CA 5.7.3 CA CA 5.7.4 CA 5.8 CA 3 CA CA P-24
6. 6.1 6.1.1 FIPS140-2 3 CA Web CA Web 6.1.2 CA 6.1.3 CA SSL 6.1.4 CA CA CA 6.1.5 CA RSA 2048 RSA 2048 Web RSA 6.1.6 CA P-25
6.1.7 CA CA 6.1-1 CA CA digital Signature yes nonrepudiation keyencipherment yes dataencipherment keyagreement keycertsign yes crlsign yes encipheronly decipheronly 6.2 6.2.1 CA FIPS140-2 3 6.2.2 CA 6.2.3 CA CA CA 6.2.4 CA P-26
6.2.5 CA CA 6.2.6 CA 6.2.7 CA 6.2.8 CA 6.2.9 CA 6.2.10 CA 6.2.11 CA CP 6.2.1. 6.3 P-27
6.3.1 CA CPS 6.2.1 6.3.2 CA 20 CA SECOM Passport for Web SR 3.0 CA 6 1 2 3 6.4 6.4.1 6.4.2 6.4.3 6.5 6.5.1 6.5.2 6.6 6.6.1 P-28
6.6.2 6.6.3 6.7 6.8 P-29
7. OCSP 7.1 CA RFC5280 7.1-1 SECOM Passport for Web SR 3.0 CA critical Version Version 3 - Serial Number ) 0123456789 - Signature Algorithm sha256 With RSA Encryption - Issuer Country C=JP - Organization O=SECOM Trust Systems CO.,LTD. - Common Name CN= SECOM Passport for Web SR - 3.0 CA Validity NotBefore ) 2008/3/1 00:00:00 GMT - NotAfter ) 2009/3/1 00:00:00 GMT - Subject Country C=JP - State Or Province - Locality - Organization - Organizational Unit - Common Name - Subject Public Key Info 2048 - critical KeyUsage digitalsignature, keyencipherment y ExtendedKeyUsage serverauth n Subject Alt Name dnsname= n CertificatePolicies policyidentifier OID=1.2.392.200091.100.751.1 policyqualifiers policyqualifierid=cps n P-30
CRL Distribution Points Authority Information Access Authority Key Identifier Subject Key Identifier qualifiier=https://repo1.secomtrust.n et/spcpp/pfw/pfwsr3ca/ http://repo1.secomtrust.net/spcpp/pf w/pfwsr3ca/fullcrl.crl accessmethod ocsp 1 3 6 1 5 5 7 48 1) accesslocation http://sr30.ocsp.secomtrust.net SHA-1 160 SHA-1 160 n n n n 7.1-2 SECOM Passport for Web SR 3.0 CA OCSP critical Version Version 3 - Serial Number ) 0123456789 - Signature Algorithm sha256 With RSA Encryption - Issuer Country C=JP - Organization O=SECOM Trust Systems CO.,LTD. - Common Name CN= SECOM Passport for Web SR - 3.0 CA Validity NotBefore ) 2008/3/1 00:00:00 GMT - NotAfter ) 2008/3/5 00:00:00 GMT - Subject Country C=JP - Organization SECOM Trust Systems CO.,LTD. - Common Name OCSP - Subject Public Key Info 2048 - critical KeyUsage digitalsignature y ExtendedKeyUsage OCSPSigning n OCSP No Check null n CertificatePolicies policyidentifier n P-31
Authority Key Identifier Subject Key Identifier OID=1.2.392.200091.100.751.1 policyqualifiers policyqualifierid=cps qualifiier=https://repo1.secomtrust.n et/spcpp/pfw/pfwsr3ca/ SHA-1 160 SHA-1 160 n n 7.2 CRL CA CRL RFC5280 7.2 SECOM Passport for Web SR 3.0 CA CRL critical Version Version 2 - Signature Algorithm SHA256 with RSAEncryption - Issuer Country C=JP - Organization O= SECOM Trust Systems CO.,LTD. - Common Name CN= SECOM Passport for Web SR - 3.0 CA This Update ) 2008/3/1 00:00:00 GMT - Next Update ) 2008/3/5 00:00:00 GMT - =24H =96H Revoked Serial Number ) 0123456789 - Certificates Revocation Date ) 2008/3/1 00:00:00 GMT - Reason Code unspecified, etc. - critical CRL Number CRL n Authority Key Identifier SHA-1 160 n 7.3 OCSP CA RFC5019 6960 OCSP P-32
7.3.1 CA OCSP 1 7.3.2 OCSP P-33
8. CA CP CPS CA CP CPS 8.1 CP CP 8.2 CA CA WebTrust CA 8.3 8.4 CA WebTrust for CA WebTrust for BR 8.5 8.6 WebTrust for CA WebTrust for BR WebTrust for CA WebTrust for BR P-34
9. 9.1 CA 9.2 CA 9.3 9.3.1 9.3.2 9.3.3 9.4 9.5 CP 9.6 9.6.1 9.6.1.1 IA IA CA P-35
RA IA CRL OCSP 9.6.1.2 RA RA IA 9.6.2 CP 9.6.3 CA CRL OCSP 9.6.4 9.7 CP 9.6.1 P-36
9.8 CP 9.6.1 CRL OCSP CA 9.9 9.10 9.10.1 CP CP 9.10.2 CP 9.10.2 CP 9.10.3 P-37
CA 9.10.3 CA 9.11 9.12 9.12.1 CP 9.12.2 CP CP 9.12.3 9.13 CA 9.14 CP CPS 9.15 CA P-38
9.16 9.16.1 CP 9.16.2 CP CPS 9.16.3 CP 9.16.4 9.17 P-39