| Version | Date | Reason for Revision |
| 1.00 | October 14, 2021 |
|
| 1.01 | November 25, 2021 |
|
| 1.02 | August 25, 2022 |
|
| 1.03 | September 21, 2022 |
|
| 1.04 | November 11, 2022 |
|
| 1.05 | April 21, 2023 |
|
| 1.06 | April 28, 2023 |
|
| 1.07 | August 24,2023 |
|
| 1.08 | March 15, 2024 |
|
| 1.09 | April 15, 2024 |
|
| 1.10 | July 30, 2024 |
|
| 1.11 | August 20, 2024 |
|
| 1.12 | September 13, 2024 |
|
| 2.00 | February 14, 2025 |
|
| Certificate Type | Use |
| EV SSL/TLS Server Certificate |
|
| OV SSL/TLS Server Certificate |
|
| Root Certificate |
|
| Subordinate CA certificate |
|
| OCSP Responder Certificate |
|
| Contact Information | ||||||
General contact in Cybertrust Japan Co., Ltd. Address: 13F SE Sapporo Bldg., 1-1-2 Kita 7-jo Nishi, Kita-ku, Sapporo-shi 060-0807 Tel: 0120-957-975 or +81-11-708-5283 Business Days: Monday to Friday (excluding National Holidays, and the designated days addressed on Cybertrust’s website including Year-End and New Year) Business Hours: 9:00 to 18:00 JST Inquiries and complaints: As indicated below
(*) The existing contact, jcsi-r@cybertrust.ne.jp, which is used for the problem report on SecureSign RootCA11 is also available. |
| DN Item | Meaning |
| Common Name | Complete host name of server or network device to use the certificate (FQDN or IP address) Note: EV SSL/TLS Server Certificate does not include any IP address or Wildcard Domain Name starting with an asterisk (*) as Common Names |
| Organization | Name of an entity of the subscriber |
| Locality | Address of business location (locality) |
| State or Province | Address of business location (state or province) |
| Country | Address of business location (country) |
Business Category * Only for EV SSL/TLS Server Certificate |
Information for identifying form of organization set forth in the EV Guidelines Private Organization Government Entity (The Subordinate CAs do not issue a certificate to Business Entity or Non-Commercial Entity.) |
Serial Number * Only for EV SSL/TLS Server Certificate |
For private organizations, indicate the corporate registration number For government entities, indicate "The Subject is a Government Entity" |
Jurisdiction of Incorporation State or Province * Only for EV SSL/TLS Server Certificates where the Jurisdiction of Incorporation or Registration of the Subscriber is State, Province, or Locality. |
Jurisdiction of Incorporation or Registration State or Province |
Jurisdiction of Incorporation Locality * Only for EV SSL/TLS Server Certificates where the Jurisdiction of Incorporation or Registration of the Subscriber is Locality. |
Jurisdiction of Incorporation or Registration Locality |
Jurisdiction of Incorporation Country * Only for EV SSL/TLS Server Certificates |
Jurisdiction of Incorporation or Registration Country |
| Subject Alternative Names | Meaning |
|---|---|
| dNSName | Complete host name of server or network device to use the certificate (FQDN). Note: EV SSL/TLS Server Certificate does not include any Wildcard Domain Name starting with an asterisk (*) as Subject Alternative Names. |
| iPAddress | Complete IP address of server or network device to use the certificate. Note: EV SSL/TLS Server Certificate does not include any IP address as Subject Alternative Names. |
| Item | Method |
| Identity | The Subordinate CA shall use, based on section 3.2.2.1 of the BR, public documents and data, the documents and data provided by a third party that is deemed reliable by the Subordinate CA, and the documents and data provided by the subscriber, as well as make inquiries to an appropriate individual affiliated with the subscriber or an organization that constitutes the subscriber. The subscriber shall be visited for verification as required. Details regarding the verification procedures to be requested to subscribers shall be posted on Cybertrust's website or notified individually to the subscribers or the person in charge of application. |
| DBA/Tradename | When the organization name to be included in the subscriber's certificate is DBA/Tradename, this Subordinate CA shall confirm the name by using public documents and data or the documents and data provided by a third party that is deemed reliable by the Subordinate CA, based on Section 3.2.2.2 of the BR. |
| Verification of Country | This Subordinate CA confirms the Country included in the subscriber's certificate based on applicable requirements such as 3.2.2.3 and 7.1.2.7.4 of the BR. In which process, the method for "Verification of Identity " defined in Appendix A for OV SSL/TLS Server Certificate is equally applied. |
| Validation of Domain Authorization or Control | The Subordinate CA shall validate, prior to issuance, the subscriber’s authorization or control of the FQDN or the domain name in accordance with applicable requirements such as Section 3.2.2.4 of the BR. The Subordinate CA validates each Fully‐Qualified Domain Name (FQDN) or the domain name listed in the certificate using at least one of the methods listed below. Provided that, the Subordinate CA does not issue any certificate for a FQDN of which the rightmost label end with “.onion”. In all cases, the validation must have been initiated within the time period specified in the relevant requirement (such as Section 4.2.1 of BR) prior to certificate issuance. For purposes of domain name validation, the term “Subscriber” includes the Subscriber's Parent Company and Subsidiary Company. The Subordinate CA SHALL maintain a record of which domain validation method, including relevant BR version number, was used to validate every domain for issuance. Note: FQDNs for certificates may be listed in subscriber certificates using dNSNames in the subjectAltName extension or in Subordinate CA Certificates via dNSNames in permitted Subtrees within the Name Constraints extension. If a Random Value is used for any of the methods below, the Subordinate CA SHALL provide a Random Value unique to the certificate request and shall not use the Random Value after 30 days from its creation. If there is validated information available for this process, it MUST not be used later than the time frame set forth in BR section 4.2.1. The Random Value SHALL be unique in each email, fax, SMS, or postal mail when the Random value is informed via these manners. The Subordinate CA MAY resend the email, fax, SMS, or postal mail including reuse of Random Value when the FQDNs and/or domain name is validated with the method with these communication manners, provided that the communications content and recipients remain unchanged. Once the FQDN or the domain name has been validated using these methods except method #8 or #18, the Subordinate CA MAY also issue certificates for other FQDNs that end with all the labels of the validated FQDN or domain name. This rule also applies to applications for a wildcard domain name of OV SSL/TLS Server Certificate. This Subordinate CA does not adopt Request Token. #1: Validating the Applicant as a Domain Contact (BR 3.2.2.4.1） The Subordinate CA does not use this method. #2: Email, Fax, SMS, or Postal Mail to Domain Contact (BR 3.2.2.4.2） The Subordinate CA confirms the Subscriber's authorization or control of the FQDN or the domain name by sending a Random Value via email, fax, SMS, or postal mail and then receiving a confirming response containing the Random Value. The Random Value MUST be sent to the email address, fax/SMS number, or postal mail address identified as a Domain Contact. Each email, fax, SMS, or postal mail MAY confirm control of multiple Authorization Domain Names. The Subordinate CA MAY send the email, fax, SMS, or postal mail identified under this section to more than one recipient provided that every recipient is identified by the Domain Name Registrar as representing the Domain Name Registrant for every FQDN being verified using the email, fax, SMS, or postal mail. #3: Phone Contact with Domain Contact (BR 3.2.2.4.3） The Subordinate CA does not use this method. #4: Constructed Email to Domain Contact (BR 3.2.2.4.4） The Subordinate CA sends emails to one or more email addresses of 'admin', 'administrator', 'webmaster', 'hostmaster', or 'postmaster' as the local part, followed by the at sign ("@") and the Authorization Domain Name. The emails contain a Random Value. The subscriber's authorization or control of the FQDN or the domain name is examined by receiving a response containing the Random Value. #5: Domain Authorization Document (BR 3.2.2.4.5） The Subordinate CA does not use this method. #6: Agreed‐Upon Change to Website (BR 3.2.2.4.6） The Subordinate CA does not use this method. #7: DNS Change (BR 3.2.2.4.7） The Subordinate CA SHALL examine the Subscriber's authorization or control of the FQDN or the domain name by confirming the presence of a Random Value for either in a DNS CNAME, TXT or CAA record for either an Authorization Domain Name or an Authorization Domain Name that is prefixed with a label that begins with an underscore character. On-or-after September 15, 2024, the Subordinate CA using this method MUST implement Multi-Perspective Issuance Corroboration in accordance with section 3.2.2.9 of the BR. To corroborate validation results as Multi-Perspective Issuance Corroboration, a remote Network Perspective MUST retrieve the same Random Value as the Primary Network Perspective. #8: IP Address (BR 3.2.2.4.8） The Subordinate CA SHALL examine the Subscriber's authorization or control of the FQDN or domain name by confirming that the Subscriber controls an IP address returned from a DNS lookup for A or AAAA records for the FQDN or domain name in accordance with Section 3.2.2.5 of the BR or this CP. On-or-after September 15, 2024, the Subordinate CA using this method MUST implement Multi-Perspective Issuance Corroboration in accordance with section 3.2.2.9 of the BR. To corroborate validation results as Multi-Perspective Issuance Corroboration, a remote Network Perspective MUST retrieve the same IP address as the Primary Network Perspective. Note: If the FQDN or the domain name has been validated using this method, the Subordinate CA MUST NOT issue certificates for other FQDNs or common names that end with all the labels of the validated FQDN or domain name unless the Subordinate CA performs a separate validation using an authorized method. This rule does not apply to the validation of a wildcard domain name of OV SSL/TLS Server Certificate. #9: Test Certificate (BR 3.2.2.4.9） The Subordinate CA does not use this method. #10: TLS Using a Random Value (BR 3.2.2.4.10） # The Subordinate CA does not use this method. #11: Any Other Method (BR 3.2.2.4.11） The Subordinate CA does not use this method. #12: Validating the Subscriber as a Domain Contact (BR 3.2.2.4.12） The Subordinate CA does not use this method. #13: Email to DNS CAA Contact (BR 3.2.2.4.13） The Subordinate CA SHALL examine the Subscriber's authorization or control of the FQDN or domain name by sending a Random Value via email to the email address that can be verified as the DNS CAA Email Contact and then receiving a confirming response containing the Random Value. The relevant CAA Resource Record Set MUST be found using the search algorithm defined in RFC8659. Each email MAY confirm control of multiple FQDNs, provided that each email address is a DNS CAA Email Contact for each Authorization Domain Name being validated. The same email MAY be sent to multiple recipients as long as all recipients are DNS CAA Email Contacts for each Authorization Domain Name being validated. On-or-after September 15, 2024, the Subordinate CA using this method MUST implement Multi-Perspective Issuance Corroboration in accordance with section 3.2.2.9 of the BR. To corroborate validation results as Multi-Perspective Issuance Corroboration, a remote Network Perspective MUST retrieve the selected email address contact used for domain validation observed by the Primary Network Perspective. #14: Email to DNS TXT Contact (BR 3.2.2.4.14） The Subordinate CA SHALL examine the Subscriber's authorization or control of the FQDN or the domain name by sending a Random Value via email to the email address contact in the DNS TXT record (DNS TXT Record Email Contact) and then receiving a confirming response containing the Random Value. Each email MAY confirm control of multiple FQDNs, provided that each email address is a DNS TXT Record Email Contact for each Authorization Domain Name being validated. The same email MAY be sent to multiple recipients as long as all recipients are DNS TXT Record Email Contacts for each Authorization Domain Name being validated. On-or-after September 15, 2024, the Subordinate CA using this method MUST implement Multi-Perspective Issuance Corroboration in accordance with section 3.2.2.9 of the BR. To corroborate validation results as Multi-Perspective Issuance Corroboration, a remote Network Perspective MUST retrieve the selected email address contact used for domain validation observed by the Primary Network Perspective. #15: Phone Contact with Domain Contact (BR 3.2.2.4.15） The Subordinate CA SHALL examine the Subscriber's authorization or control of the FQDN or the domain name by calling the Domain Contact’s phone number. Each phone call MAY confirm control of multiple Authorization Domain Names provided that the same Domain Contact phone number is listed for each Authorization Domain Name being examined and they provide a confirming response for each Authorization Domain Name. In the event that someone other than a Domain Contact is reached, the Subordinate CA MAY request to be transferred to the Domain Contact. In the event of reaching voicemail, the Subordinate CA MAY leave the Random Value and the Authorization Domain Name(s) being examined. The Random Value MUST be returned to the Subordinate CA to approve the request. #16: Phone Contact with DNS TXT Record Phone Contact (BR 3.2.2.4.16） The Subordinate CA SHALL examine the Subscriber's authorization or control of the FQDN or the domain name by calling the contact’s phone number (DNS TXT Record Phone Contact) in the DNS TXT record. Each phone call MAY confirm control of multiple Authorization Domain Names provided that the same DNS TXT Record Phone Contact phone number is listed for each Authorization Domain Name being examined and they provide a confirming response for each Authorization Domain Name. The Subordinate CA MUST NOT knowingly be transferred or request to be transferred as this phone number has been specifically listed for the purposes of Domain Validation. In the event of reaching voicemail, the Subordinate CA MAY leave the Random Value and the Authorization Domain Name(s) being examined. On-or-after September 15, 2024, the Subordinate CA using this method MUST implement Multi-Perspective Issuance Corroboration in accordance with section 3.2.2.9 of the BR. To corroborate validation results as Multi-Perspective Issuance Corroboration, a remote Network Perspective MUST retrieve the selected Contact’s phone number used for domain validation observed by the Primary Network Perspective. #17: Phone Contact with DNS CAA Phone Contact (BR 3.2.2.4.17） The Subordinate CA SHALL examine the Subscriber’s authorization or control of the FQDN or the domain name by calling a phone number verified as the DNS CAA Phone Contact. The relevant CAA Resource Record Set MUST be found by using each algorithm defined in RFC8659. Each phone call MAY confirm control of multiple Authorization Domain Names provided that the same DNS CAA Phone Contact phone number is listed for each Authorization Domain Name being verified, and they provide a confirming response for each Authorization Domain Name. The Subordinate CA MUST NOT knowingly be transferred or request to be transferred as this phone number has been specifically listed for the purposes of Domain Validation. In the event of reaching voicemail, the Subordinate CA MAY leave the Random Value and the Authorization Domain Name(s) being examined. The Random Value MUST be returned to the Subordinate CA to approve the request. On-or-after September 15, 2024, the Subordinate CA using this method MUST implement Multi-Perspective Issuance Corroboration in accordance with section 3.2.2.9 of the BR. To corroborate validation results as Multi-Perspective Issuance Corroboration, a remote Network Perspective MUST retrieve the selected Contact’s phone number used for domain validation observed by the Primary Network Perspective. #18: Agreed‐Upon Change to Website v2 (BR 3.2.2.4.18） Confirming the Applicant's control over the FQDN by verifying that the Random Value is contained in the contents of a file.
The file containing the Random Value:
If the Subordinate CA follows redirects the following apply:
If a Random Value is used, then:
On-or-after September 15, 2024, the Subordinate CA using this method MUST implement Multi-Perspective Issuance Corroboration in accordance with section 3.2.2.9 of the BR. To corroborate validation results as Multi-Perspective Issuance Corroboration, a remote Network Perspective MUST retrieve the same Random Value as the Primary Network Perspective. Note: For the certificate issued using this method, the Subordinate CA shall validate each of requested FQDNs and shall not issue certificates for the different FQDNs that end with all the labels of the validated FQDNs unless the Subordinate CA processes another validation. This rule does not apply to the validation of a wildcard domain name of OV SSL/TLS Server Certificate. #19: Agreed‐Upon Change to Website - ACME (BR 3.2.2.4.19） The Subordinate CA does not use this method. #20: TLS Using ALPN (BR 3.2.2.4.20） The Subordinate CA does not use this method. |
| Authentication for an IP Address | The Subordinate CA Shall verify, prior to issuance, the subscriber’s authorization or control of the IP address in accordance with Section 3.2.2.5 of the BR. The Subordinate CA validates each IP address listed in the certificate using at least one of the methods listed below. In all cases, the validation must have been initiated within the time period specified in the relevant requirement (such as Section 4.2.1 of BR) prior to certificate issuance. For purposes of IP address validation, the term Subscriber includes the Subscriber's Parent Company and Subsidiary Company. The Subordinate CA SHALL maintain a record of which validation method, including relevant BR version number, was used to validate every IP address. Note: The IP address confirmed by Section 3.2.2.5 may be described in the subscriber certificate and the subordinate CA certificate via the IP address in the permitted subtree within the name restriction extension as stipulated in Section 7.1.4.2 of the BR. Describing it in the subordinate CA certificate need not be verified via the IP address in the excluded subtree of the name restriction extension. If a Random Value is used for any of the methods below, the Subordinate CA SHALL provide a Random Value unique to the certificate request and shall not use the Random Value after 30 days from its creation. If there is validated information available for this process, it MUST not be used later than the time frame set forth in BR section 4.2.1. The Subordinate CA does not adopt Request Token. #1: Agreed‐Upon Change to Website (BR 3.2.2.5.1） The Subordinate CA confirms the IP address that is accessible in the metatag format under the "/.well-known/pki-validation" directory or in another path registered with IANA for the purpose of IP address validation via HTTP/HTTPS over an Authorized Port. It also verifies the Subscriber's authorization or control of the IP address by confirming the presence of a Random Value. The Random Value MUST NOT appear in the request. On-or-after September 15, 2024, the Subordinate CA using this method MUST implement Multi-Perspective Issuance Corroboration in accordance with section 3.2.2.9 of the BR. To corroborate validation results as Multi-Perspective Issuance Corroboration, a remote Network Perspective MUST retrieve the same Random Value as the Primary Network Perspective. #2: Email, Fax, SMS, or Postal Mail to IP Address Contact (BR 3.2.2.5.2） The Subordinate CA does not use this method. #3: Reverse IP Address Lookup (BR 3.2.2.5.3） The Subordinate CA acquires the domain name associated with the IP address via reverse IP lookup of the IP address. It also verifies the subscriber's authorization or control of the IP address by using the method allowed in 3.2.2.4 “Validation of Domain Authorization or Control" of this CP to confirm that the subscriber controls the FQDN. On-or-after September 15, 2024, the Subordinate CA using this method MUST implement Multi-Perspective Issuance Corroboration in accordance with section 3.2.2.9 of the BR. To corroborate validation results as Multi-Perspective Issuance Corroboration, a remote Network Perspective MUST retrieve the same FQDN as the Primary Network Perspective. #4: Any Other Method (BR 3.2.2.5.4） The Subordinate CA does not use this method. #5: Phone Contact with IP Address Contact (BR 3.2.2.5.5） The Subordinate CA does not use this method. #6: ACME “http-01” method for IP Addresses (BR 3.2.2.5.6） The Subordinate CA does not use this method. #7: ACME “tls-alpn-01” method for IP Addresses (BR 3.2.2.5.7） The Subordinate CA does not use this method. |
| Validation of Authority and Authorization | Based on section 3.2.5 of BR, the Subordinate CA shall verify, via a communication method equivalent with phone call to the application supervisor, that the application supervisor has accepted the Subscriber Agreement and approved the person in charge of application to submit a certificate request. The Subordinate CA may use the data source verified in "Verification of Identity " defined in Appendix A for OV SSL/TLS Server Certificate to confirm the contact information for the "Validation of Authority and Authorization" to the application supervisor. |
| Validation for Application with High Risk Status | The Subordinate CA shall maintain an internal database of all previously revoked Certificates and previously rejected certificate requests due to suspected phishing or other fraudulent usage or concerns based on section 4.2.1 of the BR. The Subordinate CA SHALL use this information to identify subsequent suspicious certificate requests and determine the certificate request as high risk if applicable. The Subordinate CA SHALL additionally confirm the database of higher risk for phishing or other fraudulent usage which is deemed appropriate by the Subordinate CA, and for those applications requested by the subscriber that is included in the database requires additional verification activity by the CA to ensure such requests are properly verified under respective requirements. In addition, no Certificate shall be issued when the Subscriber is listed on any government denial list or prohibited list such as embargo under the laws of the CA’s jurisdiction. |
| Reusable period of Validation Data | The Subordinate CA MAY reuse documents, data, and previous validation results (including the validation on the subscriber’s authorization or control over the domain name or the IP address) provided based on Section 3.2 of BR for less than 398 days from the day the initial validation completes to issue multiple Certificates. The Subordinate CA shall again verify the information for the certificate request if the previous validation results are expired. |
| Item | Method |
| Identity | The Subordinate CA SHALL verify existence and Identity based on section 3.2.2.2, 3.2.2.4, 3.2.2.6, and Appendix D-1 Japan of the EV Guidelines, such as,
The Subordinate CA shall additionally verify the Applicant's operational existence by using one or more than one of following methods based on section 3.2.2.6 of the EV Guidelines.
|
| DBA/Tradename | The Subordinate CA does not allow DBA/Tradename to be included in the subscriber's EV SSL/TLS Server Certificate. |
| Verification of Country | The Subordinate CA SHALL verify Country based on section 3.2.2.4 and 7.1.4.2.6 of the EV Guidelines, and the procedure of the method for "Verification of Identity " defined in Appendix A for EV SSL/TLS Server Certificate is equally applied. |
| Validation of Domain Authorization or Control | The Subordinate CA SHALL verify Domain Authorization or Control based on section 3.2.2.7 of the EV Guidelines; and section 3.2.2.4 of the BR. In which process, the procedure of each methods in "Validation of Domain Authorization or Control" defined in Appendix A for OV SSL/TLS Server Certificate is equally applied. The EV SSL/TLS Server Certificate request is determined to be high-risk when a domain name that contains mixed characters and an existing high-risk domain name are compared visually and similarity is observed. To ensure that the subscriber is not a high-risk target organization, additional authentication and verification that are reasonably appropriate shall be conducted. The Subordinate CA does not issue EV SSL/TLS Server Certificate including the IP address. |
| Validation of Authority and Authorization | The Subordinate CA SHALL verify Authority based on section 3.2.2.8 and 3.2.2.9 of the EV Guidelines. Prior to verification to Application Supervisor, the Subordinate CA shall verify the name and title of the application supervisor and the authority to submit a certificate request on behalf of the subscriber based on the EV Guidelines. The Subordinate CA shall verify, based on section 3.2.2.10 of the EV Guidelines by using a verified communication method, that Application Supervisor has signed Subscriber Agreement and acknowledged that the certificate request submitted by Person in charge of application. The Subordinate CA may use the contact information of phone number, email address, or postal address verified with one or more of following data sources, based on section 3.2.2.5 of the EV Guidelines.
|
| Validation for Application with High Risk Status | The Subordinate CA shall verify the certificate request with high risk based on section 3.2.2.12.1 of the EV Guidelines, and the method for "Validation for Application with High Risk Status" defined in Appendix A for OV SSL/TLS Server Certificate is equally applied In addition, no EV SSL/TLS Server Certificate shall be issued when the Subscriber is listed on any government denial list or prohibited list such as embargo under the laws of the CA’s jurisdiction. Based on section 3.2.2.7 of the EV Guidelines, the domain names containing mixed character set in compliance with the rules set forth by the domain registrar shall be validated in the same manner of high risk validation method for OV SSL/TLS Server Certificate as high risk status if included in the certificate. |
| Reusable period of Validation Data | The Subordinate CA MAY reuse the documents, data, and previous validation results (including the validation on the subscriber’s authorization or control over the domain name) provided based on section 3.2 of the EV Guidelines for less than 398 days from the day the initial validation completes to issue multiple Certificates, except when the EV Guidelines allows longer period. The Subordinate CA shall again verify the information for the certificate request if the previous validation results are expired. |
| Term | Definition |
| Archive | As used herein, the term "archive" refers to the process of storing expired certificates for a predetermined period. |
| Application Software Supplier | A supplier of software or other relying-party application software that displays or uses the Certificates, incorporates Root Certificates, and adopts the CA/Browser Forum’s Requirements as all or part of its requirements for participation in a root store program. |
| Cryptographic Module | Software, hardware, or a device configured from the combination of such software and hardware that is used for ensuring security in the generation, storage and use of Private Keys. |
| Suspension | Measure for temporarily invalidating a certificate during the effective period of that certificate. |
| Corporate identification number | 12 digits number for identification assigned to corporates and organizations in accordance with regulation of "Commercial Registration Act" (https://www.japaneselawtranslation.go.jp/ja/laws/view/4186), which number is available at http://www.moj.go.jp/MINJI/minji06_00076.html for reference. |
| Key Size | A bit number that represents the key size (number of digits), which is also a factor in deciding the cryptographic strength. |
| Key Pair | A public key and a Private Key in public key cryptography. The two keys are unique in that one key cannot be derived from the other key. |
| Activation | To cause a system or device to be usable. Activation requires activation data, and specifically includes a PIN and pass phrase. |
| Subscriber Agreement | An agreement to be accepted by a subscriber to apply for and use a certificate. This CP constitutes a part of the Subscriber Agreement. |
| Compromise | A state where the confidentiality or integrity of information that is incidental to the Private Key and the Private Key is lost. |
| Public Key | One key of the key pair in public key cryptography that is notified to and used by the other party (communication partner, etc.). |
| Subject | The Legal Entity identified in a Certificate as the Subject. The Subject is the Subscriber. |
| Revocation | Measure for invalidating a certificate even during the effective period of that certificate. |
| Certificate Management System | A system used by a CA or Delegated Third Party to process, approve issuance of, or store certificates or certificate status information, including the database, database server, and storage. |
| Certificate Revocation List | Abbreviated as "CRL" in this CP. CRL is a list of revoked certificates. The CA publishes CRL so that the Relying Parties can verify the validity of certificates. |
| Certificate Systems | The system used by a CA or Delegated Third Party in providing identity verification, registration and enrollment, certificate approval, issuance, validity status, support, and other PKI‐related services. |
| Certificate Requester | A natural person who is the Applicant, employed by the Applicant, an authorized agent who has express authority to represent the Applicant, or the employee or agent of a third party (such as software publisher) who completes and submits a Certificate Request on behalf of the Applicant. |
| Registration Identifier | The unique code assigned to an Applicant by the Incorporating or Registration Agency in such entity’s Jurisdiction of Incorporation or Registration. |
| Certification Operations | Series of operations that are performed during the life cycle controls of certificates. Including, but not limited to, operations of accepting issuance/revocation requests, validation operations, issuance/revocation/discarding operations, operations of responding to inquiries, billing operations, and system maintenance and management operations of the CA. |
| Backup Site | A facility that is separate from the main site for storing important assets of the CA required for certificate issuance and revocation to ensure business continuity during disasters, etc. |
| Private Key | One key of the key pair in public key cryptography that is kept private from third parties other than a subscriber. |
| Corporate Number | 13 digits number for identification assigned, by National Tax Agency, to corporates and other entities which number is available at https://www.houjin-bangou.nta.go.jp/ for reference. |
| Main Site | A facility equipped with assets of the CA required for certificate issuance and revocation. |
| Escrow | As used herein, the term "deposit" refers to the processing of registering and storing a Private Key or a public key at a third party. |
| Repository | A website or system for posting public information such as this CP and CRL. |
| Apple Root Certificate Program | The requirements which Apple imposes Root CAs to have their certificates trusted and included as the Root CA Certificate in Apple products. |
| Linting | A process in which the content of digitally signed data such as a Precertificate, Certificates, CRL, or OCSP Response, or data-to-be-signed object such as a `tbsCertificate` (as described in RFC 5280, Section 4.1.1.1) is checked for conformance with the profiles and requirements defined in the BR. |
| Baseline Requirements for the Issuance and Management of Publicly‐Trusted S/MIME Certificates | Requirements for issuing publicly trusted S/MIME certificates which were formulated by the CA/Browser Forum. |
| ACME | Abbreviation for "Automated Certificate Management Environment" and it is a standard protocol for automate the processes of domain names verification, installation, and management for X.509 certificates. |
| ALPN | Abbreviation for "Application-Layer Protocol Negotiation" and it is an extended function of TLS. |
| Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates (BR) | Requirements for issuing publicly trusted TLS Server certificates which were formulated by the CA/Browser Forum. |
| CA/Browser Forum | Organization that consists of the CA that issue publicly-trusted certificates for SSL/TLS communications and the companies that develop applications such as browsers. It creates standards about certificates. The website of the organization is https://cabforum.org/. |
| Chrome Root Program Policy | The requirements which Google imposes Root CAs to have their certificates trusted and included as the Root CA Certificate in Google products. |
| Extended Validation Certificate (EV Certificate) | EV SSL/TLS Server certificates that are issued based on the "Guidelines for the Issuance and Management of Extended Validation Certificates" set forth by the CA/Browser Forum and are used for the authentication of servers in SSL/TLS communication. |
| Guidelines for the Issuance and Management of Extended Validation Certificates (EV Guidelines) | Requirements for issuing EV SSL/TLS Server Certificates, which were formulated by the CA/Browser Forum. |
| Certificate Transparency | A scheme standardized in RFC6962 for promptly discovering and detecting fraudulent certificates. |
| DBA/Tradename | Indicates a common name, trade name, shop name, etc. other than the legal name of an organization. |
| Distinguished Name | An identifier set forth in the X.500 recommendation formulated by ITU-T. Configured from attribute information such as a common name, organization name, and country name. |
| DNS CAA Email Contact | The email address defined in section A.1.1 of BR. |
| DNS CAA Phone Contact | The phone number defined in section A.1.2 of BR. |
| DNS CA Authorization Resource Record (CAA Record) | One of the DNS records defined in RFC8659 and RFC9495 which aims to clarify the certification authority to issue the certificate to a domain name and prevent the issuance of unintended certificates. |
| DNS TXT Record Email Contact | The email address defined in section A.2.1 of BR. |
| DNS TXT Record Phone Contact | The phone number defined in section A.2.2 of BR. |
| FIPS 140-2 | FIPS (Federal Information Processing Standards Publication 140) is a U.S. federal standard that prescribes the specifications of security requirements in a cryptographic module. With this standard, the security requirements are classified as the levels of 1 (lowest) to 4 (highest). |
| Fully-Qualified Domain Name (FQDN) | A domain name to which a sub domain name and a host name are added and is included in a certificate. |
| IETF PKIX Working Group | Internet Engineering Task Force (IETF) is an organization that standardizes technologies used for the Internet, and the PKIX Working Group of IETF set forth RFC3647. |
| Program Requirements - Microsoft Trusted Root Program | The requirements which Microsoft imposes Root CAs to have their certificates trusted and included as the Root CA Certificate in Microsoft products. |
| Mozilla Root Store Policy | The requirements which Mozilla imposes Root CAs to have their certificates trusted and included as the Root CA Certificate in Mozilla products. |
| Multi-Perspective Issuance Corroboration | Refers to the process of obtaining same validation results as a domain validation and/or CAA check, confirmed using multiple Network Perspectives before Certificate issuance. This process can protect against Border Gateway Protocol (BGP) attacks or hijacks and improve the reliability of the validation results. Network Perspective refers to a system that operates on a network to obtain the information necessary for some validations. The Network Perspective used as the primary system is called the Primary Network Perspective, while the Network Perspective operating from a remote location is referred to as the remote Network Perspective. |
| Network and Certificate System Security Requirements | The requirements developed by CA/Browser Forum for the security on network of publicly trusted certificate and the security of CA systems. |
| IP Address | 32-bit or 128-bit label that is assigned to a device that uses the Internet Protocol for communications. |
| ITU-T | Telecommunications Standardization Sector of the International Telecommunication Union. |
| LEI (Legal Entity Identifier) | An international identifier assigned by the International Organization for Standardization (ISO) which enables clear and unique identification of legal entities participating in financial transactions. |
| Multi-Perspective Issuance Corroboration | Refers to the process of obtaining same validation results as a domain validation and/or CAA check, confirmed using multiple Network Perspectives before Certificate issuance. This process can protect against Border Gateway Protocol (BGP) attacks or hijacks and improve the reliability of the validation results. Network Perspective refers to a system that operates on a network to obtain the information necessary for some validations. The Network Perspective used as the primary system is called the Primary Network Perspective, while the Network Perspective operating from a remote location is referred to as the remote Network Perspective. |
| Name Constraints | Registration of the Key Usage and Name Constraint extensions in a certificate of a certification authority to restrict the issue of a subscriber certificate. |
| OCSP | Abbreviation of "Online Certificate Status Protocol", and is a communication protocol for providing certificate revocation information. The CA is operating an OCSP responder if needed, in addition to publicly disclosing CRL, so that a Relying Party can verify the validity of a certificate. |
| Organization-validated Strict Generation | Certificates of Strict generational Organization-validated type among the S/MIME Certificates issued based on "Baseline Requirements for the Issuance and Management of Publicly‐Trusted S/MIME Certificates" as set forth by the CA/Browser Forum and used for S/MIME signing. |
| Precertificate | Certificate addressed in RFC 6962 of Certificate Transparency. |
| Punycode | Punycode is a method, defined in RFC 3492, designed to encode an Internationalized Domain Names (IDN). The value transformed its Unicode string into an ASCII characters with ACE prefix "xn--" added in accordance with Punycode encoding method shall be called "A-label". |
| RFC7231 | The document named "Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content" defining semantics of HTTP/1.1 message which is set forth by the IETF PKIX Working Group. |
| RFC7538 | The document named "The Hypertext Transfer Protocol Status Code 308 (Permanent Redirect)" defining the additional Hypertext Transfer Protocol (HTTP) status code 308 (Permanent Redirect) which is set forth by the IETF PKIX Working Group. |
| RSA | Public key cryptography developed by Rivest, Shamir, and Adelman. |
| SHA1/SHA256 | A hash function used in digital signatures, etc. A hash function is used for reducing data into a given length based on mathematical operations and makes it infeasible to calculate the same output value from two different input values. It is also infeasible to inverse the input value from the output value. |
| SSL/TLS | A protocol for encrypting and sending/receiving information on the Internet which was developed by Netscape Communications. TLS is an improvement of SSL 3.0. |
| Technically Constrained Subordinate CA | The Technically Constrained Subordinate CA Certificate set forth in the Baseline Requirements. That is, the Subordinate CA which uses the Subordinate CA Certificate containing Key Usage Extension and Name Constraint Extension in it to constrain the issuance of Subscriber Certificates. |
| WebTrust Principles and Criteria | Audit standards established by CPA Canada to evaluate the appropriateness and effectiveness of certification authority operations. |
| X.500 | International standard of distribution directory services to be provided on a network standardized by ITU-T. |
| X.509 | International standard of digital certificates standardized by ITU-T. |
| version | value | |
|---|---|---|
| Version | Version of the encoded certificate | |
|
2 (Ver.3) | |
| serialNumber | value | |
| CertificateSerialNumber | Serial number of certificate | |
|
1 (0x01) | |
| signature | value | |
| AlgorithmIdentifier | The identifier for the signature algorithm used by the CA to sign this certificate |
|
|
Object ID for the signature algorithm (SHA-1) | |
|
1.2.840.113549.1.1.5 | |
|
Parameters of signature algorithm | |
|
NULL | |
| issuer | value | |
| countryName | Country-name attribute of certificate issuer | |
|
Object ID for the country name | |
|
2.5.4.6 | |
|
Value for the country name | |
|
JP | |
| organizationName | Organization-name attribute of certificate issuer | |
|
Object ID for the organization name | |
|
2.5.4.10 | |
|
Value for the organization name | |
|
Japan Certification Services, Inc. | |
| commonName | Common-name attribute of certificate issuer | |
|
Object ID for the common name | |
|
2.5.4.3 | |
|
Value for the common name | |
|
SecureSign RootCA11 | |
| validity | value | |
| Validity | Validity period of certificate | |
|
the date on which the certificate validity period begins | |
|
090408045647Z | |
| 2009年4月8日 04:56:47(GMT) | ||
|
The date on which the certificate validity period ends | |
|
290408045647Z | |
| 2029年4月8日 04:56:47(GMT) | ||
| subject | value | |
| countryName | Country-name attribute of certificate subject | |
|
Object ID for the country name | |
|
2.5.4.6 | |
|
Value for the country name | |
|
JP | |
| organizationName | Organization-name attribute of certificate subject | |
|
Object ID for the organization name | |
|
2.5.4.10 | |
|
Value of organization name | |
|
Japan Certification Services, Inc. | |
| commonName | Common-name attribute of certificate issuer | |
|
Object ID for the common name | |
|
2.5.4.3 | |
|
Valu for the common name | |
|
SecureSign RootCA11 | |
| subjectPublicKeyInfo | value | |
| SubjectPublicKeyInfo | Subject’s public key information | |
|
the identifier for the cryptographic algorithm | |
|
Object ID for the cryptographic algorithm | |
|
1.2.840.113549.1.1.1 (rsaEncryption) | |
|
Parameters of cryptographic algorithm | |
|
NULL | |
|
Value of public key | |
|
*Public key of 2048 bit size | |
| subjectKeyIdentifier (extnId :== 2 5 29 14，critical :== FALSE) | value | |
|---|---|---|
| SubjectKeyIdentifier | Information of Subject Key Identifier | |
|
The identifier for the public key | |
|
5BF84D4FB2A586D43AD2F1639AA0BE09F657B7DE | |
| keyUsage (extnId :== 2 5 29 15，critical :== TRUE) | keyUsage (extnId :== 2 5 29 15，critical :== TRUE) | |
| KeyUsage | Key Usage | |
|
00000110 (0x06) (keyCertSign,cRLSign) |
|
| basicConstraints (extnId :== 2 5 29 19，critical :== TRUE) | basicConstraints (extnId :== 2 5 29 19，critical :== TRUE) | |
| BasicConstraints | Basic Constraints | |
|
The flag to determine whether the supplied certificate is associated with a CA or an end entity | |
|
TRUE | |
| version | value | |
|---|---|---|
| Version | Version of the encoded certificate | |
|
2 (Ver.3) | |
| serialNumber | value | |
| CertificateSerialNumber | Serial number of certificate | *One of the following values: |
|
RCA12: 587887345431707215246142177076162061960426065942 (0x66F9C7C1AFECC251B4ED5397E6E682C32B1C9016) |
|
RCA14: 575790784512929437950770173562378038616896959179 (0x64DB5A0C204EE8D72977C85027A25A27DD2DF2CB) |
||
RCA15: 126083514594751269499665114766174399806381178503 (0x1615C7C3D849A7BE690C8A88EDF070F9DDB73E87) |
||
| signature | value | |
| AlgorithmIdentifier | TThe identifier for the signature algorithm used by the CA to sign this certificate | |
|
Object ID for the signature algorithm | *One of the following values: |
|
RCA12: 1.2.840.113549.1.1.11 (sha256WithRSAEncryption) |
|
RCA14, and RCA16: 1.2.840.113549.1.1.12 (sha384WithRSAEncryption) |
||
RCA15: 1.2.840.10045.4.3.3 (ecdsa-with-SHA384) |
||
|
Parameters of signature algorithm | *Only for RCA12, and RCA14 |
|
NULL | |
| issuer | Value | |
| countryName | Country name attribute of certificate issuer | |
|
Object ID for the country name | |
|
2.5.4.6 | |
|
Value of country name | |
|
JP | |
| organizationName | Organization name attribute of certificate issuer | |
|
Object ID for organization name | |
|
2.5.4.10 | |
|
Value of organization name | |
|
Cybertrust Japan Co., Ltd. | |
| commonName | Common name attribute of certificate issuer | |
|
Object ID for common name | |
|
2.5.4.3 | |
|
Value of common name | *One of the following values: |
|
RCA12: SecureSign Root CA12 |
|
RCA14: SecureSign Root CA14 |
||
RCA15: SecureSign Root CA15 |
||
| validity | value | |
| Validity | Validity period of the certificate | |
|
The date on which the certificate validity period begins | *One of the following values: |
|
RCA12: 200408053646Z (April 8, 2020 14:36:46 JST) |
|
RCA14: 200408070619Z (April 8, 2020 16:06:19 JST) |
||
RCA15: 200408083256Z (April 8, 2020 17:32:56 JST) |
||
|
The date on which the certificate validity period ends | *One of the following values: |
|
RCA12: 400408053646Z (April 8, 2040 14:36:46 JST) |
|
RCA14: 450408070619Z (April 8, 2045 16:06:19 JST) |
||
RCA15: 450408083256Z (April 8, 2045 17:32:56 JST) |
||
| subject | value | |
| countryName | Country name attribute of certificate subject | |
|
Object ID for the country name | |
|
2.5.4.6 | |
|
Value of country name | |
|
JP | |
| organizationName | Organization name attribute of certificate subject | |
|
Object ID for organization name | |
|
2.5.4.10 | |
|
Value of organization name | |
|
Cybertrust Japan Co., Ltd. | |
| commonName | Common name attribute of certificate subject | |
|
Object ID for common name | |
|
2.5.4.3 | |
|
Value of common name | *One of the following values: |
|
RCA12: SecureSign Root CA12 |
|
RCA14: SecureSign Root CA14 |
||
RCA15: SecureSign Root CA15 |
||
| subjectPublicKeyInfo | value | |
| SubjectPublicKeyInfo | Subject’s public key information | |
|
The identifier for cryptographic algorithm | |
|
Object ID for the cryptographic algorithm | *One of the following values: |
|
RCA12, RCA14, and RCA16: 1.2.840.113549.1.1.1 (rsaEncryption) |
|
RCA15: 1.2.840.10045.2.1 (id-ecPublicKey) |
||
|
Parameters of cryptographic algorithm | *One of the following values: |
|
RCA12, RCA14, and RCA16: NULL |
|
RCA15: 1.3.132.0.34 (secp384r1) |
||
|
Value of public key | *One of the following values: |
|
RCA12: *Public key of 2048 bit size |
|
RCA14, and RCA16: *Public key of 4096 bit size |
||
RCA15: *Public key of 384 bit size |
||
| basicConstraints (extnId :== 2 5 29 19, critical :== TRUE) | value | |
|---|---|---|
| BasicConstraints | Basic Constraints | |
|
The flag to determine whether the supplied certificate is associated with a CA or an end entity | |
|
TRUE | |
| keyUsage (extnId :== 2 5 29 15, critical :== TRUE) | value | |
| KeyUsage | Key Usage | |
|
00000110 (0x06) (keyCertSign, cRLSign) |
|
| subjectKeyIdentifier (extnId :== 2 5 29 14, critical :== FALSE) | value | |
| SubjectKeyIdentifier | Information of Subject Key Identifier | |
|
The identifier for public key | *One of the following values: |
| type: OCTET STRING | RCA12: 5734F374CF044BD525E6F140B62C4CD92DE9A0AD |
|
RCA14: 0693A30A5E286937AA611DEBEBFC2D6F23E4F3A0 |
||
RCA15: EB41C8AEFCD59E5148F5BD8BF4872093412BD3F4 |
||
| version | value | |
|---|---|---|
| Version | Version of the encoded certificate | |
|
2 (Ver.3) | |
| serialNumber | value | |
| CertificateSerialNumber | Serial number of certificate | |
|
669394234770181081919879261157056934939221937491 (0x7540acf59d071d7a7ecafc2fb965a7d11415cd53) |
|
| signature | value | |
| AlgorithmIdentifier | The identifier for the signature algorithm used by the CA to sign this certificate | |
|
Object ID for the signature algorithm | |
|
1.2.840.113549.1.1.11 ( sha256WithRSAEncryption) | |
|
Parameters of signature algorithm | |
|
NULL | |
| issuer | value | |
| countryName | Country name attribute of certificate issuer | |
|
Object ID for the country name | |
|
2.5.4.6 | |
|
Value of country name | |
|
JP | |
| organizationName | Organization name attribute of certificate issuer | |
|
Object ID for organization name | |
|
2.5.4.10 | |
|
Value of organization name | |
|
Japan Certification Services, Inc. | |
| commonName | Common name attribute of certificate issuer | |
|
Object ID for common name | |
|
2.5.4.3 | |
|
Value of common name | |
|
SecureSign RootCA11 | |
| validity | value | |
| Validity | Validity period of the certificate | |
|
The date on which the certificate validity period begins | |
|
181011013633Z (October 11, 2018 1:36:33 GMT) |
|
|
The date on which the certificate validity period ends | |
|
290408045647Z (April 8, 2029 4:56:47 GMT) |
|
| subject | value | |
| countryName | Country name attribute of certificate subject | |
|
Object ID for the country name | |
|
2.5.4.6 | |
|
Value of country name | |
|
JP | |
| organizationName | Organization name attribute of certificate subject | |
|
Object ID for organization name | |
|
2.5.4.10 | |
|
Value of organization name | |
|
Cybertrust Japan Co.,Ltd. | |
| commonName | Common name attribute of certificate subject | |
|
Object ID for common name | |
|
2.5.4.3 | |
|
Value of common name | |
|
JCSI TLSSign Public CA | |
| subjectPublicKeyInfo | value | |
| SubjectPublicKeyInfo | Subject’s public key information | |
|
The identifier for cryptographic algorithm | |
|
Object ID for the cryptographic algorithm | |
|
1.2.840.113549.1.1.1 (rsaEncryption) | |
|
Parameters of cryptographic algorithm | |
|
NULL | |
|
Value of public key | |
|
*2048bit size of public key | |
| basicConstraints (extnId :== 2 5 29 19，critical :== TRUE) | value | ||
|---|---|---|---|
| BasicConstraints | Basic Constraints | ||
|
The flag to determine whether the supplied certificate is associated with a CA or an end entity | ||
|
TRUE | ||
|
PathLenConstraint | ||
|
0 | ||
| certificatePolicies (extnId :== 2 5 29 32，critical :== FALSE) | value | ||
| PolicyInformation | Information of the Policy | ||
|
Object ID for the Policy | ||
|
2.5.29.32.0 (anyPolicy) | ||
|
Information of the policy qualifiers | ||
|
Classification of policy qualifiers | ||
|
1.3.6.1.5.5.7.2.1 (CPSuri) | ||
|
URI of CPS is published | ||
|
|||
| https://www.cybertrust.ne.jp/jcsi/repository.html | |||
| Name Constraints (extnId :== 2.5.29.30，critical :== TRUE) | value | ||
| Name Constraints | Name Constraints | ||
|
dNS Name | .managedpki.ne.jp | |
| Directory Name | O=Cybertrust Japan Co.,Ltd., L=Minato-ku, ST=Tokyo, C=JP | ||
|
IP address (IPv4) | 0.0.0.0/0.0.0.0 | |
| IP address (IPv6) | 0:0:0:0:0:0:0:0/0 | ||
| authorityInfoAccess (extnId :== 1 3 6 1 5 5 7 1 1，critical :== FALSE) | value | ||
| Authority Information Access | Authority Information Access | ||
|
Online Certificate Status Protocol | ||
|
Access method | ||
|
1.3.6.1.5.5.7.48.1 (ocsp) | ||
|
Access location | ||
|
http://rtocsp.managedpki.ne.jp/ OcspServer |
||
|
Issuer of the Authority | ||
|
|
||
|
1.3.6.1.5.5.7.48.2 (caIssuers) | ||
|
|
http://rtcrl.managedpki.ne.jp/ SecureSignAD/SecureSignRootCA11/SSAD-rca.crt |
|
| keyUsage (extnId :== 2 5 29 15，critical :== TRUE) | value | ||
| KeyUsage | Key Usage | ||
|
10000110 (0x86) (Digital Signature,keyCertSign,cRLSign) |
||
| extKeyUsage (extnId :== 2 5 29 37，critical :== FALSE) | extKeyUsage (extnId :== 2 5 29 37，critical :== FALSE) | ||
| ExtKeyUsage | Extended Key Usage | ||
|
The purpose of the key contained in the certificate | ||
|
1.3.6.1.5.5.7.3.1 (serverAuth) | ||
| authorityKeyIdentifier (extnId :== 2 5 29 35，critical :== FALSE) | authorityKeyIdentifier (extnId :== 2 5 29 35，critical :== FALSE) | ||
| AuthorityKeyIdentifier | Information of Authority Key Identifier | ||
|
The identifier for the public key | ||
|
5BF84D4FB2A586D43AD2F1639AA0BE09F657B7DE | ||
| cRLDistributionPoints (extnId :== 2 5 29 31，critical :== FALSE) | cRLDistributionPoints (extnId :== 2 5 29 31，critical :== FALSE) | ||
| cRLDistributionPoints | CRL Distribution Point | ||
|
CRL Distribution Point | ||
|
URI of CRL Distribution Point | ||
|
http://rtcrl.managedpki.ne.jp/SecureSignAD/SecureSignRootCA11/cdp.crl | ||
| subjectKeyIdentifier (extnId :== 2 5 29 14，critical :== FALSE) | subjectKeyIdentifier (extnId :== 2 5 29 14，critical :== FALSE) | ||
| SubjectKeyIdentifier | Subject Key Identifier | ||
|
The identifier for the public key | ||
|
D3342FDDF84C99DE843F051DB9D9F440D9C08BB1 | ||
| version | value | |
|---|---|---|
| Version | Version of the encoded certificate | |
|
2 (Ver.3) | |
| serialNumber | value | |
| CertificateSerialNumber | Serial number of certificate | *One of the following values: |
|
EVCA7: 253871017432188711949194414046884150249969284120 (0x2C77F85B12969E757EAC8921C7155089AE35F418) |
|
EVCA8: 711557647551209168260412389303640762322044180483 (0x7CA3593373BD43AA87416AB0439DAC5D0361D803) |
||
EVCA9: 670330029353397387367279429585581215447244928789 (0x756AA35ABA8847DD5103C33A37B168FA13A4F715) |
||
SSCA7: 128404668628304561596392169718195621015372084939 (0x167DDD4E7ABD348B6A105BC9CA24ACE745F2B6CB) |
||
SSCA8: 442497590356880787032587269713624319867761233890 (0x4D8247384ADF541F88340F4928553224B6C48FE2) |
||
| signature | value | |
| AlgorithmIdentifier | TThe identifier for the signature algorithm used by the CA to sign this certificate | |
|
Object ID for the signature algorithm | *One of the following values: |
|
EVCA7, and SSCA7: 1.2.840.113549.1.1.11 (sha256WithRSAEncryption) |
|
EVCA9: 1.2.840.113549.1.1.12 (sha384WithRSAEncryption) |
||
EVCA8, and SSCA8: 1.2.840.10045.4.3.3 (ecdsa-with-SHA384) |
||
|
Parameters of signature algorithm | *Only for EVCA7, EVCA9, and SSCA7 |
|
NULL | |
| issuer | value | |
| countryName | Country name attribute of certificate issuer | |
|
Object ID for the country name | |
|
2.5.4.6 | |
|
Value of country name | |
|
JP | |
| organizationName | Organization name attribute of certificate issuer | |
|
Object ID for organization name | |
|
2.5.4.10 | |
|
Value of organization name | |
|
Cybertrust Japan Co., Ltd. | |
| commonName | Common name attribute of certificate issuer | |
|
Object ID for common name | |
|
2.5.4.3 | |
|
Value of common name | *One of the following values: |
|
EVCA7, and SSCA7: SecureSign Root CA12 |
|
EVCA9: SecureSign Root CA14 |
||
EVCA8, and SSCA8: SecureSign Root CA15 |
||
| validity | value | |
| Validity | Validity period of the certificate | |
|
The date on which the certificate validity period begins | *One of the following values: |
|
EVCA7: 200622073438Z (June 22, 2020 16:34:38 JST) |
|
EVCA8: 200622093921Z (June 22, 2020 18:39:21 JST) |
||
EVCA9: 200622085022Z (June 22, 2020 17:50:22 JST) |
||
SSCA7: 200622074205Z (June 22, 2020 16:42:05 JST) |
||
SSCA8: 200622094515Z (June 22, 2020 18:45:15 JST) |
||
|
The date on which the certificate validity period ends | *One of the following values: |
|
EVCA7: 300622073438Z (June 22, 2030 16:34:38 JST) |
|
EVCA8: 300622093921Z (June 22, 2030 18:39:21 JST) |
||
EVCA9: 300622085022Z (June 22, 2030 17:50:22 JST) |
||
SSCA7: 300622074205Z (June 22, 2030 16:42:05 JST) |
||
SSCA8: 300622094515Z (June 22, 2030 18:45:15 JST) |
||
| subject | value | |
| countryName | Country name attribute of certificate subject | |
|
Object ID for the country name | |
|
2.5.4.6 | |
|
Value of country name | |
|
JP | |
| organizationName | Organization name attribute of certificate subject | |
|
Object ID for organization name | |
|
2.5.4.10 | |
|
Value of organization name | |
|
Cybertrust Japan Co., Ltd. | |
| commonName | Common name attribute of certificate subject | |
|
Object ID for common name | |
|
2.5.4.3 | |
|
Value of common name | *One of the following values: |
|
EVCA7: Cybertrust Japan SureServer EV CA G7 |
|
EVCA8: Cybertrust Japan SureServer EV CA G8 |
||
EVCA9: Cybertrust Japan SureServer EV CA G9 |
||
SSCA7: Cybertrust Japan SureServer CA G7 |
||
SSCA8: Cybertrust Japan SureServer CA G8 |
||
| subjectPublicKeyInfo | value | |
| SubjectPublicKeyInfo | Subject’s public key information | |
|
The identifier for cryptographic algorithm | |
|
Object ID for the cryptographic algorithm | *One of the following values: |
|
EVCA7, EVCA9, and SSCA7: 1.2.840.113549.1.1.1 (rsaEncryption) |
|
EVCA8, and SSCA8: 1.2.840.10045.2.1 (id-ecPublicKey) |
||
|
Parameters of cryptographic algorithm | *One of the following values: |
|
EVCA7, EVCA9, and SSCA7: NULL |
|
EVCA8, and SSCA8: 1.3.132.0.34 (secp384r1) |
||
|
Value of public key | *One of the following values: |
|
EVCA7, and SSCA7: *Public key of 2048 bit size |
|
EVCA9: *Public key of 4096 bit size |
||
EVCA8, and SSCA8: *Public key of 384 bit size |
||
| basicConstraints (extnId :== 2 5 29 19, critical :== TRUE) | value | |
|---|---|---|
| BasicConstraints | Basic Constraints | |
|
The flag to determine whether the supplied certificate is associated with a CA or an end entity | |
|
TRUE | |
| pathLenConstraint |
|
|
|
0 | |
| certificatePolicies (extnId :== 2 5 29 32, critical :== FALSE) | value | |
| PolicyInformation | Information of the Policy | |
|
Object ID for the Policy | *One of the following values: |
|
EVCA7, EVCA8, and EVCA9: 1.2.392.200081.1.32.1 |
|
SSCA7, and SSCA8: 1.2.392.200081.1.32.2 |
||
|
Information of the policy qualifiers | |
|
Classification of the policy qualifiers | |
|
1.3.6.1.5.5.7.2.1 (CPSuri) | |
|
|
|
|
https://www.cybertrust.ne.jp/ssl/repository_rt/index.html | |
| PolicyInformation | Information of the Policy | |
|
Object ID for the Policy | *One of the following values: |
|
EVCA7, EVCA8, and EVCA9: 2.23.140.1.1 (CABF Extended Validation) |
|
SSCA7, and SSCA8: 2.23.140.1.2.2 (CABF Organization Validated) |
||
| authorityInfoAccess (extnId :== 1 3 6 1 5 5 7 1 1, critical :== FALSE) | value | |
| AuthorityInfoAccess | Authority Information Access | |
|
Online Certificate Status Protocol | |
|
Access method | |
|
1.3.6.1.5.5.7.48.1 (ocsp) | |
|
Access location | |
| type: IA5String | http://rtocsp.cybertrust.ne.jp/OcspServer | |
|
Issuer of the Authority | |
|
Access method | |
|
1.3.6.1.5.5.7.48.2 (caIssuers) | |
|
Access location | *One of the following values: |
|
EVCA7, and SSCA7: http://rtcrl.cybertrust.ne.jp/SecureSign/rtca12/rtca12.crt |
|
EVCA9: http://rtcrl.cybertrust.ne.jp/SecureSign/rtca14/rtca14.crt |
||
EVCA8, and SSCA8: http://rtcrl.cybertrust.ne.jp/SecureSign/rtca15/rtca15.crt |
||
| keyUsage (extnId :== 2 5 29 15, critical :== TRUE) | value | |
| KeyUsage | Key Usage | |
|
10000110 (0x86) (digitalSignature, keyCertSign, cRLSign) |
|
| extKeyUsage (extnId :== 2 5 29 37, critical :== FALSE) | value | |
| ExtKeyUsage | Extended Key Usage | |
|
The purpose of the key contained in the certificate | |
|
1.3.6.1.5.5.7.3.1 (serverAuth) 1.3.6.1.5.5.7.3.2 (clientAuth) |
|
| authorityKeyIdentifier (extnId :== 2 5 29 35, critical :== FALSE) | value | |
| AuthorityKeyIdentifier | Information of Authority Key Identifier | |
|
The identifier for public key | *One of the following values: |
|
EVCA7, and SSCA7: 5734F374CF044BD525E6F140B62C4CD92DE9A0AD |
|
EVCA9: 0693A30A5E286937AA611DEBEBFC2D6F23E4F3A0 |
||
EVCA8, and SSCA8: EB41C8AEFCD59E5148F5BD8BF4872093412BD3F4 |
||
| cRLDistributionPoints (extnId :== 2 5 29 31, critical :== FALSE) | value | |
| CRLDistributionPoints | CRL Distribution Point | |
|
CRL Distribution Point | |
|
URI of CRL Distribution Point | *One of the following values: |
|
EVCA7, and SSCA7: http://rtcrl.cybertrust.ne.jp/SecureSign/rtca12/cdp.crl |
|
EVCA9: http://rtcrl.cybertrust.ne.jp/SecureSign/rtca14/cdp.crl |
||
EVCA8, and SSCA8: http://rtcrl.cybertrust.ne.jp/SecureSign/rtca15/cdp.crl |
||
| subjectKeyIdentifier (extnId :== 2 5 29 14, critical :== FALSE) | value | |
| SubjectKeyIdentifier | Information of Subject Key Identifier | |
|
The identifier for public key | *One of the following values: |
|
EVCA7: 7483319BF875CD0DCF8E84E6D28E9AA6794C2AA6 |
|
EVCA8: AEE4FDC16E22F8DFB71383F8E2D143B696B93AC8 |
||
EVCA9: EDB8FA2F3D7D25BEE354B165CE54A8833B92F0C7 |
||
SSCA7: 8E3C286393A4E4850F5489DD69B23C52674AB5A4 |
||
SSCA8: 3DD29719E5391699EE6BB01B7AC6F3FACAF5F703 |
||
| version | value | |
|---|---|---|
| Version | Version of the encoded certificate | |
|
2 (Ver.3) | |
| serialNumber | value | |
| CertificateSerialNumber | Serial number of certificate | |
|
*Serial number of certificate (unique positive integer) | |
| signature | value | |
| AlgorithmIdentifier | The identifier for the signature algorithm used by the CA to sign this certificate | |
|
Object ID for the signature algorithm | |
|
1.2.840.113549.1.1.11 ( sha256WithRSAEncryption) | |
|
Parameters of signature algorithm | |
|
NULL | |
| issuer | value | |
| countryName | Country name attribute of certificate issuer | |
|
Object ID for the country name | |
|
2.5.4.6 | |
|
Value of country name | |
|
JP | |
| organizationName | Organization name attribute of certificate issuer | |
|
Object ID for the organization name | |
|
2.5.4.10 | |
|
Value of organization name | |
|
Cybertrust Japan Co.,Ltd. | |
| commonName | Common name attribute of certificate issuer | |
|
Object ID for the common name | |
|
2.5.4.3 | |
|
Value of common name | |
|
JCSI TLSSign Public CA | |
| validity | value | |
| Validity | Validity period of certificate | |
|
The date on which the certificate validity period begins | |
|
*The date and time on which the certificate validity period begins | |
|
The date on which the certificate validity period ends | |
|
*The date and time on which the certificate validity period ends | |
| subject | value | |
| countryName | Validated country name attribute of certificate subject | |
|
Object ID for the country name | |
|
2.5.4.6 | |
|
Value of country name | |
|
JP | |
| stateOrProvinceName | Validated state or Province name attribute of certificate subject | |
|
Object ID for the state or province name | |
|
2.5.4.8 | |
|
value of state or province name | |
|
*State or province name attribute of certificate subject | |
| localityName | Validated locality name attribute of certificate subject | |
|
Object ID for the locality name | |
|
2.5.4.7 | |
|
Value of locality name | |
|
*Locality name attribute of certificate subject | |
| organizationName | Organization name attribute of certificate issuer | |
|
Object ID for the organization name | |
|
2.5.4.10 | |
|
Value of organization name | |
|
*Organization name attribute of certificate subject | |
| commonName | Common name attribute of certificate issuer | |
|
Object ID for the common name | |
|
2 5 4 3 | |
|
Value of common name | |
|
* Common name attribute of certificate issuer * FQDN of the SSL/TLS server |
|
| * Note: domain: managedpki.ne.jp | ||
| subjectPublicKeyInfo | value | |
| SubjectPublicKeyInfo | Subject’s public key information | |
|
The identifier for the cryptographic algorithm | |
|
Object ID for the cryptographic algorithm | |
|
1.2.840.113549.1.1.1 (rsaEncryption) | |
|
Parameters of cryptographic algorithm | |
|
NULL | |
|
Value of public key | |
|
*The key size is depended on application | |
| *The key size must be at least 2048 bit | ||
| basicConstraints (extnId :== 2 5 29 19，critical :== TRUE) | value | |
|---|---|---|
| BasicConstraints | Basic Constraints | |
|
The flag to determine whether the supplied certificate is associated with a CA or an end entity | |
|
FALSE | |
| certificatePolicies (extnId :== 2 5 29 32，critical :== FALSE) | value | |
| PolicyInformation | Information of the Policy | |
|
Object ID for the Policy | |
|
1.2.392.200081.1.10.10 | |
|
Information of the policy qualifiers | |
|
Classification of policy qualifiers | |
|
1.3.6.1.5.5.7.2.1 (CPSuri) | |
|
URI of CPS is published | |
|
https://www.cybertrust.ne.jp/ssl/repository_rt/ | |
| PolicyInformation | Information of the Policy | |
|
Object ID for the Policy | |
|
2.23.140.1.2.2 | |
| value | value | |
| SubjectAltName | Subject Alternative Name | |
|
dnsName | |
|
* FQDN of the SSL/TLS server * Note: Domain: .managedpki.ne.jp |
|
| authorityInfoAccess (extnId :== 1 3 6 1 5 5 7 1 1，critical :== FALSE) | value | |
| AuthorityInfoAccess | Authority Information Access | |
|
Online Certificate Status Protocol | |
|
Access method | |
|
1.3.6.1.5.5.7.48.1 (ocsp) | |
|
Access location | |
|
http://jcsitlssignpublicca-ocsp. managedpki.ne.jp/OcspServer |
|
|
Issuer of the Authority | |
|
Access method | |
|
1.3.6.1.5.5.7.48.2 (caIssuers) | |
|
Access location | |
|
http://rtcrl.managedpki.ne.jp/ SecureSignAD/JCSITLSSignPublicCA/SSAD-JCSITLS.crt |
|
| keyUsage (extnId :== 2 5 29 15，critical :== TRUE) | value | |
| KeyUsage | Key Usage | |
|
10100000 (0xa0) (digitalSignature,keyEncipherment) |
|
| extKeyUsage (extnId :==2 5 29 37，critical :== FALSE) | value | |
| ExtKeyUsage | Extended Key Usage | |
| KeyPurposeId | The purpose of the key contained in the certificate | |
|
1.3.6.1.5.5.7.3.1 (serverAuth) 1.3.6.1.5.5.7.3.2 (clientAuth) |
|
| authorityKeyIdentifier (extnId :== 2 5 29 35，critical :== FALSE) | value | |
| AuthorityKeyIdentifier | Authority Key Identifier | |
|
The identifier for public key | |
|
d3 34 2f dd f8 4c 99 de 84 3f 05 1d b9 d9 f4 40 d9 c0 8b b1 |
|
| cRLDistributionPoints (extnId :== 2 5 29 31，critical :== FALSE) | value | |
| cRLDistributionPoints | CRL Distribution Point | |
|
CRL Distribution Point | |
|
URI of CRL Distribution Point | |
|
http://rtcrl.managedpki.ne.jp/ SecureSignAD/JCSITLSSign PublicCA/cdp.crl |
|
| subjectKeyIdentifier (extnId :== 2 5 29 14，critical :== FALSE) | value | |
| SubjectKeyIdentifier | Subject Key Identifier（Based on RFC 5280, Section 4.2.1.2） | |
|
The identifier for the public key | |
|
* Hash value of subjectPublicKey | |
| version | value | |
|---|---|---|
| Version | Version of the encoded certificate | |
|
2 (Ver.3) | |
| serialNumber | value | |
| CertificateSerialNumber | Serial number of certificate | |
|
*Serial number of certificate (unique positive integer) | |
| signature | value | |
| AlgorithmIdentifier | TThe identifier for the signature algorithm used by the CA to sign this certificate | |
|
Object ID for the signature algorithm | *One of the following values: |
|
EVCA7, and SSCA7: 1.2.840.113549.1.1.11 (sha256WithRSAEncryption) |
|
EVCA9: 1.2.840.113549.1.1.12 (sha384WithRSAEncryption) |
||
EVCA8, and SSCA8: 1.2.840.10045.4.3.3 (ecdsa-with-SHA384) |
||
|
Parameters of signature algorithm | *Only for EVCA7, EVCA9, and SSCA7 |
|
NULL | |
| issuer | value | |
| countryName | Country name attribute of certificate issuer | |
|
Object ID for the country name | |
|
2.5.4.6 | |
|
Value of country name | |
|
JP | |
| organizationName | Organization name attribute of certificate issuer | |
|
Object ID for organization name | |
|
2.5.4.10 | |
|
Value of organization name | |
|
Cybertrust Japan Co., Ltd. | |
| commonName | Common name attribute of certificate issuer | |
|
Object ID for common name | |
|
2.5.4.3 | |
|
Value of common name | *One of the following values: |
|
EVCA7: Cybertrust Japan SureServer EV CA G7 |
|
EVCA8: Cybertrust Japan SureServer EV CA G8 |
||
EVCA9: Cybertrust Japan SureServer EV CA G9 |
||
SSCA7: Cybertrust Japan SureServer CA G7 |
||
SSCA8: Cybertrust Japan SureServer CA G8 |
||
| validity | value | |
| Validity | Validity period of certificate | |
|
The date on which the certificate validity period begins | |
|
*The date on which the certificate validity period begins | |
|
The date on which the certificate validity period ends | |
|
*The date on which the certificate validity period ends | |
| subject | value | |
| jurisdictionOfIncorporationCountryName | Jurisdiction of incorporation country name attribute of certificate subject | *Only for EVCA7, EVCA8, and EVCA9 |
|
Object ID for the jurisdiction of incorporation state or province name | |
|
1.3.6.1.4.1.311.60.2.1.3 | |
|
Value of jurisdiction of incorporation state or province name | |
|
JP (Fixed value) | |
| jurisdictionOfIncorporationStateOrProvinceName | Jurisdiction of incorporation state or province name attribute of certificate subject | *Only for EVCA7, EVCA8, and EVCA9 *present if the jurisdiction incorporation is state/province or locality |
|
Object ID for the jurisdiction of incorporation state or province name | |
|
1.3.6.1.4.1.311.60.2.1.2 | |
|
Value of jurisdiction of incorporation state or province name | |
|
*Jurisdiction of incorporation state or province name | |
| jurisdictionOfIncorporationLocalityName | Jurisdiction of incorporation locality name attribute of certificate subject | *Only for EVCA7, EVCA8, and EVCA9 *present if the jurisdiction incorporation is locality |
|
Object ID for the jurisdiction of incorporation locality name | |
|
1.3.6.1.4.1.311.60.2.1.1 | |
|
Value of jurisdiction of incorporation locality name | |
|
*Jurisdiction of incorporation locality name | |
| serialNumber | Registration number attribute of certificate subject | *Only for EVCA7, EVCA8, and EVCA9 |
|
Object ID for the registration number | |
|
2.5.4.5 | |
|
Value of registration number | |
|
*Registration number attribute of certificate subject *When business category of the applicant is private organization, it is required registration number when business category of the applicant is government entity, it is required "The Subject is a Government Entity” |
|
| businessCategory | Business category attribute of certificate subject | *Only for EVCA7, EVCA8, and EVCA9 |
|
Object ID for the business category | |
|
2.5.4.15 | |
|
Value of business category | |
|
*Business category attribute of certificate subject Private: Private Organization Government: Government Entity (The Subordinate CAs do not issue a certificate to Business: Business Entity or Non-Commercial: Non-Commercial Entity.) |
|
| countryName | Validated country name attribute of certificate subject | |
|
Object ID for the country name | |
|
2.5.4.6 | |
|
Value of country name | |
|
*Validated country name attribute of certificate subject | |
| stateOrProvinceName | Validated state or Province name attribute of certificate subject | |
|
Object ID for the state or province name | |
|
2.5.4.8 | |
|
Value of state or province name | |
|
*Validated state or province name attribute of certificate subject | |
| localityName | Validated locality name attribute of certificate subject | |
|
Object ID for the locality name | |
|
2.5.4.7 | |
|
Value of locality name | |
|
*Validated locality name attribute of certificate subject | |
| organizationName | Formal organization name attribute of certificate subject | |
|
Object ID for organization name | |
|
2.5.4.10 | |
|
Value of organization name | |
|
*Formal organization name attribute of certificate subject | |
| commonName | Common name attribute of certificate subject | |
|
Object ID for common name | |
|
2.5.4.3 | |
|
Value of common name | |
|
*a single IP address or FQDN of the SSL/TLS server *IP address only for OV |
|
| subjectPublicKeyInfo | value | |
| SubjectPublicKeyInfo | Subject’s public key information | |
|
The identifier for cryptographic algorithm | |
|
Object ID for the cryptographic algorithm | *One of the following values: |
|
EVCA7, EVCA9, and SSCA7: 1.2.840.113549.1.1.1 (rsaEncryption) |
|
EVCA8, and SSCA8: 1.2.840.10045.2.1 (id-ecPublicKey) |
||
|
Parameters of cryptographic algorithm | *One of the following values: |
|
EVCA7, EVCA9, and SSCA7: NULL |
|
EVCA8, and SSCA8: *One of the following values: 1.2.840.10045.3.1.7 (secp256r1) 1.3.132.0.34 (secp384r1) |
||
|
Value of public key | |
|
*The key size depends on application *The key size must be at least 2048 bit (EVCA7, SSCA7, and EVCA9) or 256 bit (EVCA8, and SSCA8) |
|
| basicConstraints (extnId :== 2 5 29 19, critical :== TRUE) | value | |
|---|---|---|
| BasicConstraints | Basic Constraints | |
|
The flag to determine whether the supplied certificate is associated with a CA or an end entity | |
|
FALSE | |
| certificatePolicies (extnId :== 2 5 29 32, critical :== FALSE) | value | |
| PolicyInformation | Information of the Policy | |
|
Object ID for the Policy | *One of the following values: |
|
EVCA7, EVCA8, and EVCA9: 1.2.392.200081.1.32.1 |
|
SSCA7, and SSCA8: 1.2.392.200081.1.32.2 |
||
|
Information of the policy qualifiers | |
|
Classification of the policy qualifiers | |
|
1.3.6.1.5.5.7.2.1 (CPSuri) | |
|
URI of CPS is published | |
|
https://www.cybertrust.ne.jp/ssl/repository_rt/index.html | |
| PolicyInformation | Information of the Policy | |
|
Object ID for the Policy | *One of the following values: |
|
EVCA7, EVCA8, and EVCA9: 2.23.140.1.1 (CABF Extended Validation) |
|
SSCA7, and SSCA8: 2.23.140.1.2.2 (CABF Organization Validated) |
||
| authorityInfoAccess (extnId :== 1 3 6 1 5 5 7 1 1, critical :== FALSE) | value | |
| AuthorityInfoAccess | Authority Information Access | |
|
Online Certificate Status Protocol | |
|
Access method | |
|
1.3.6.1.5.5.7.48.1 (ocsp) | |
|
Access location | *One of the following values: |
|
EVCA7, EVCA8, and EVCA9: http://evocsp.cybertrust.ne.jp/OcspServer |
|
SSCA7, and SSCA8: http://ssocsp.cybertrust.ne.jp/OcspServer |
||
|
Issuer of the Authority | |
|
Access method | |
|
1.3.6.1.5.5.7.48.2 (caIssuers) | |
|
Access location | *One of the following values: |
|
EVCA7: http://evcrl.cybertrust.ne.jp/SureServer/evcag7/evcag7.crt |
|
EVCA8: http://evcrl.cybertrust.ne.jp/SureServer/evcag8/evcag8.crt |
||
EVCA9: http://evcrl.cybertrust.ne.jp/SureServer/evcag9/evcag9.crt |
||
SSCA7: http://sscrl.cybertrust.ne.jp/SureServer/ovcag7/ovcag7.crt |
||
SSCA8: http://sscrl.cybertrust.ne.jp/SureServer/ovcag8/ovcag8.crt |
||
| subjectAltName (extnId :== 2 5 29 17, critical :== FALSE) | value | |
| SubjectAltName | Subject Alternative Name | |
|
dNS Name or iPAddress | |
|
*FQDN or IP address of the SSL/TLS server *IP address only for OV |
|
| keyUsage (extnId :== 2 5 29 15, critical :==TRUE) | value | |
| KeyUsage | Key Usage | *One of the following values: |
| type: BIT STRING | EVCA7, EVCA9, and SSCA7: 10100000 (0xA0) (digitalSignature, keyEncipherment) |
|
EVCA8, and SSCA8: 10000000 (0x80) (digitalSignature) |
||
| extKeyUsage (extnId :== 2 5 29 37, critical :== FALSE) | value | |
| ExtKeyUsage | Extended Key Usage | |
|
The purpose of the key contained in the certificate | |
|
1.3.6.1.5.5.7.3.1 (serverAuth) 1.3.6.1.5.5.7.3.2 (clientAuth) |
|
| authorityKeyIdentifier (extnId :== 2 5 29 35, critical :== FALSE) | value | |
| AuthorityKeyIdentifier | Authority Key Identifier | |
|
The identifier for public key | *One of the following values: |
|
EVCA7: 7483319BF875CD0DCF8E84E6D28E9AA6794C2AA6 |
|
EVCA8: AEE4FDC16E22F8DFB71383F8E2D143B696B93AC8 |
||
EVCA9: EDB8FA2F3D7D25BEE354B165CE54A8833B92F0C7 |
||
SSCA7: 8E3C286393A4E4850F5489DD69B23C52674AB5A4 |
||
SSCA8: 3DD29719E5391699EE6BB01B7AC6F3FACAF5F703 |
||
| cRLDistributionPoints (extnId :== 2 5 29 31, critical :== FALSE) | value | |
| CRLDistributionPoints | CRL Distribution Point | |
|
CRL Distribution Point | |
|
URI of CRL Distribution Point | *One of the following values: |
|
EVCA7: http://evcrl.cybertrust.ne.jp/SureServer/evcag7/cdp.crl |
|
EVCA8: http://evcrl.cybertrust.ne.jp/SureServer/evcag8/cdp.crl |
||
EVCA9: http://evcrl.cybertrust.ne.jp/SureServer/evcag9/cdp.crl |
||
SSCA7: http://sscrl.cybertrust.ne.jp/SureServer/ovcag7/cdp.crl |
||
SSCA8: http://sscrl.cybertrust.ne.jp/SureServer/ovcag8/cdp.crl |
||
| subjectKeyIdentifier (extnId :== 2 5 29 14, critical :== FALSE) | value | |
| SubjectKeyIdentifier | Subject Key Identifier（Based on RFC 5280, Section 4.2.1.2） | |
|
The identifier for public key | |
|
*Hash value of the BIT STRING subjectPublicKey | |
| SignedCertificateTimestampList (extnId :== 1 3 6 1 4 1 11129 2 4 2, critical :== FALSE) | value | |
SignedCertificateTimestampList
|
Timestamp list for Certificate Transparency Timestamp of Certificate Transparency |
|
|
*Signed CertificateTimestamp List | |
| version | value | |
|---|---|---|
| Version | ||
|
1 (Ver.2) | |
| signature | value | |
| AlgorithmIdentifier | The identifier for the signature algorithm used by the CRL issuer to sign the CertificateList | |
|
Object ID for the signature algorithm | |
|
1.2.840.113549.1.1.11 ( sha256WithRSAEncryption) | |
|
Parameters of signature algorithm | |
|
NULL | |
| issuer | value | |
| countryName | Country-name attribute of CRL issuer | |
|
Object ID for the country name | |
|
2.5.4.6 | |
|
Value of country name | |
|
JP | |
| organizationName | Organization-name attribute of CRL issuer | |
|
Object ID for the organization name | |
|
2.5.4.10 | |
|
Value of organization name | *One of the following values: |
|
Root CA Japan Certification Services, Inc. |
|
Subordinate CA Cybertrust Japan Co.,Ltd. |
||
| commonName | Common-name attribute of CRL issuer | |
|
Object ID for the common name | |
|
2.5.4.3 | |
|
Value of common name | *One of the following values: |
|
Root CA SecureSign RootCA11 |
|
Subordinate CA JCSI TLSSign Public CA (reference) |
||
| thisUpdate | value | |
| thisUpdate | the issue date of this CRL | |
|
*The date on which the certificate validity period begins | |
| nextUpdate | value | |
| nextUpdate | the date by which the next CRL will be issued | |
|
*The date by which the next CRL is issued | |
| cRLNumber (extnId :== 2 5 29 20，critical :== FALSE) | value | |
| cRLNumber | ||
|
*Serial number of CRL | |
| authorityKeyIdentifier (extnId :== 2 5 29 35，critical :== FALSE) | value | |
| AuthorityKeyIdentifier | Certification Authority Key Identifier | |
|
the identifier for the public key of CA which issued CRL | *One of the following values: |
|
Root CA 5b f8 4d 4f b2 a5 86 d4 3a d2 f1 63 9a a0 be 09 f6 57 b7 de |
|
Subordinate CA d3 34 2f dd f8 4c 99 de 84 3f 05 1d b9 d9 f4 40 d9 c0 8b b1 |
||
| issuingDistributionPoint (extnId :== 2 5 29 28，critical :== FALSE) | value | |
| issuingDistributionPoint | CRL issuing distribution point | |
|
CRL Distribution Point | |
|
URI of CRL is published | |
|
http://rtcrl.managedpki.ne.jp/SecureSignAD/JCSITLSSignPublicCA/cdp.crl | |
|
The flag to indicate that CRL contains only for user certs. | |
|
TRUE | |
|
The flag to indicate that CRL contains only for CA certs. | |
|
FALSE | |
|
The flag to indicate that CRL is indirect CRL. | |
|
FALSE | |
| revokedCertificates | value | |
| CertificateSerialNumber | Serial number of revoked certificate | |
|
*Serial number of revoked certificate | |
| revocationDate | The date on which the revocation occurred | |
|
*The date on which the revocation occurred | |
| invalidityDate (extnId :== 2 5 29 24，critical :== FALSE) | value | |
| invalidityDate | The date on which it is known or suspected that the certificate became invalid | |
|
*The date on which the revocation of the certificate occurred. | |
| cRLReason (extnId :== 2 5 29 21，critical :== FALSE) | value | |
| CRLReason | The reason for the certificate revocation | |
|
*Value of reason code for the revocation | |
| version | value | |
|---|---|---|
| Version | Version of the CRL (Revocation list) | |
|
1 (Ver.2) | |
| signature | value | |
| AlgorithmIdentifier | The identifier for the signature algorithm used by the CRL issuer to sign the CertificateList | |
|
Object ID for the signature algorithm | *One of the following values: |
|
RCA12, EVCA7, and SSCA7 1.2.840.113549.1.1.11 (sha256WithRSAEncryption) |
|
RCA14, and EVCA9: 1.2.840.113549.1.1.12 (sha384WithRSAEncryption) |
||
RCA15, EVCA8, and SSCA8: 1.2.840.10045.4.3.3 (ecdsa-with-SHA384) |
||
|
Parameters of signature algorithm | *Only for RCA12, RCA14, EVCA7, EVCA9, and SSCA7 |
|
NULL | |
| issuer | value | |
| countryName | Country name attribute of CRL issuer | |
|
Object ID for the country name | |
|
2.5.4.6 | |
|
Value of country name | |
|
JP | |
| organizationName | Organization name attribute of CRL issuer | |
|
Object ID for organization name | |
|
2.5.4.10 | |
|
Value of organization name | |
|
Cybertrust Japan Co., Ltd. | |
| commonName | Common name attribute of CRL issuer | |
|
Object ID for common name | |
|
2.5.4.3 | |
|
Value of common name | *One of the following values: |
|
RCA12: SecureSign Root CA12 |
|
RCA14: SecureSign Root CA14 |
||
RCA15: SecureSign Root CA15 |
||
EVCA7: Cybertrust Japan SureServer EV CA G7 |
||
EVCA8: Cybertrust Japan SureServer EV CA G8 |
||
EVCA9: Cybertrust Japan SureServer EV CA G9 |
||
SSCA7: Cybertrust Japan SureServer CA G7 |
||
SSCA8: Cybertrust Japan SureServer CA G8 |
||
| thisUpdate | value | |
| thisUpdate | The issue date of this CRL | |
|
*The date on which the certificate validity period begins | |
| nextUpdate | value | |
| nextUpdate | The date by which the next CRL is issued | |
|
*The date by which the next CRL is issued | |
| cRLNumber (extnId :== 2 5 29 20, critical :== FALSE) | value | |
|---|---|---|
| cRLNumber | CRL Number | |
|
*Serial number of CRL | |
| authorityKeyIdentifier (extnId :== 2 5 29 35, critical :== FALSE) | value | |
| AuthorityKeyIdentifier | Authority Key Identifier | |
|
The identifier for public key | *One of the following values: |
|
RCA12: 5734F374CF044BD525E6F140B62C4CD92DE9A0AD |
|
RCA14: 0693A30A5E286937AA611DEBEBFC2D6F23E4F3A0 |
||
RCA15: EB41C8AEFCD59E5148F5BD8BF4872093412BD3F4 |
||
EVCA7: 7483319BF875CD0DCF8E84E6D28E9AA6794C2AA6 |
||
EVCA8: AEE4FDC16E22F8DFB71383F8E2D143B696B93AC8 |
||
EVCA9: EDB8FA2F3D7D25BEE354B165CE54A8833B92F0C7 |
||
SSCA7: 8E3C286393A4E4850F5489DD69B23C52674AB5A4 |
||
SSCA8: 3DD29719E5391699EE6BB01B7AC6F3FACAF5F703 |
||
| issuingDistributionPoint (extnId :== 2 5 29 28, critical :== TRUE) | value | |
| issuingDistributionPoint | CRL issuing distribution point | *Excluding RCA12, RCA14, RCA15, and RCA16 |
|
CRL Distribution Point | |
|
URI of CRL is published | *One of the following values: |
|
EVCA7: http://evcrl.cybertrust.ne.jp/SureServer/evcag7/cdp.crl |
|
EVCA8: http://evcrl.cybertrust.ne.jp/SureServer/evcag8/cdp.crl |
||
EVCA9: http://evcrl.cybertrust.ne.jp/SureServer/evcag9/cdp.crl |
||
SSCA7: http://sscrl.cybertrust.ne.jp/SureServer/ovcag7/cdp.crl |
||
SSCA8: http://sscrl.cybertrust.ne.jp/SureServer/ovcag8/cdp.crl |
||
|
The flag to indicate that CRL contains only for user certs. | |
|
TRUE | |
|
The flag to indicate that CRL contains only for CA certs. | |
|
FALSE | |
|
The flag to indicate that CRL is indirect CRL. | |
|
FALSE | |
| revokedCertificates | value | |
|---|---|---|
| CertificateSerialNumber | Serial number of revoked certificate | |
|
*Serial number of revoked certificate | |
| revocationDate | The date on which the revocation occurred | |
|
*The date on which the revocation occurred | |
| invalidityDate (extnId :== 2 5 29 24, critical :== FALSE) | value | |
|---|---|---|
| invalidityDate | The date on which it is known or suspected That the certificate became invalid | |
|
*The date on which the revocation of the certificate occurred. | |
| cRLReason (extnId :== 2 5 29 21, critical :== FALSE） | value | |
| CRLReason | The reason code for the certificate revocation | |
|
*Value of reason code for the revocation | |
| Version | value | |
|---|---|---|
| type:INTEGER | 2 (Ver.3) | |
| serialNumber |
|
|
| CertificateSerialNumber | value | |
| type:INTEGER | 669394234770181081919879261157056934939221937491 (0x7540acf59d071d7a7ecafc2fb965a7d11415cd53) |
|
| signature |
|
|
| AlgorithmIdentifier | value | |
| algorithm | Object ID for the signature algorithm | |
| type:OID | 1.2.840.113549.1.1.11 ( sha256WithRSAEncryption) | |
| parameters |
|
|
| type:NULL | NULL | |
| issuer |
|
|
| countryName | value | |
| type | Object ID for the country name | |
| type:OID | 2.5.4.6 | |
| value |
|
|
| type:PrintableString | JP | |
| organizationName |
|
|
| type | Object ID for the organization name | |
| type: OID | 2.5.4.10 | |
| value |
|
|
| type: PrintableString | Japan Certification Services, Inc. | |
| commonName |
|
|
| type |
|
|
| type:OID | 2.5.4.3 | |
|
Value of common name | |
|
SecureSign RootCA11 | |
|
Version of the encoded certificate | |
|
2 (Ver.3) | |
| serialNumber |
|
|
| validity | value | |
| Validity | Validity period of certificate | |
|
the date on which the certificate validity period begins | |
|
*The date on which the certificate validity period begins | |
|
The date on which the certificate validity period ends | |
|
*The date on which the certificate validity period ends | |
| Subject | value | |
| countryName | Country name attribute of the certificate issuer | |
|
Object ID for the country name | |
|
2.5.4.6 | |
|
Value of country name | |
|
JP | |
| organizationName | Organization name attribute of certificate issuer | |
|
Object ID for the organization name | |
|
2.5.4.10 | |
|
Value of organization name | |
|
Japan Certification Services, Inc. | |
| commonName |
|
|
| type | Object ID for the common name | |
| type:OID | 2.5.4.3 | |
| value |
|
|
| type:PrintableString | SecureSign RootCA11 OCSP Responder | |
| countryName |
|
|
| type |
|
|
| subjectPublicKeyInfo | value | |
| parameters | Parameters of cryptographic algorithm | parameters |
| type:NULL | ||
|
Value of public key | subjectPublicKey |
|
||
|
value | version |
| Version |
|
Version |
| type:INTEGER | ||
| serialNumber |
|
serialNumber |
| basicConstraints (extnId :== 2 5 29 19，critical :== TRUE) | value | |
|---|---|---|
| BasicConstraints | Basic Constraints | |
|
The flag to determine whether the supplied certificate is associated with a CA or an end entity | |
|
FALSE | |
| ocspNoCheck (extnId :== 1.3.6.1.5.5.7.48.1.5，critical :== FALSE) | value | |
| OCSP No Check | Revocation checking of signer’s certificates | |
| Do not check revocation | NULL | |
| keyUsage (extnId :== 2 5 29 15，critical :== TRUE) | keyUsage (extnId :== 2 5 29 15，critical :== TRUE) | |
| KeyUsage | Key Usage | |
|
10000000 (0x80) (digitalSignature) |
|
| extKeyUsage (extnId :== 2 5 29 37，critical :== FALSE) | extKeyUsage (extnId :== 2.5.29.37，critical :== FALSE) | |
| ExtKeyUsage | Extended Key Usage | |
|
The purpose of the key contained in the certificate | |
|
1.3.6.1.5.5.7.3.9 (OCSPSigning) | |
| authorityKeyIdentifier (extnId :== 2 5 29 35，critical :== FALSE) | authorityKeyIdentifier (extnId :== 2 5 29 35，critical :== FALSE) | |
| AuthorityKeyIdentifier | AuthorityKeyIdentifier | |
|
CA11: 5BF84D4FB2A586D43AD2F1639AA0BE09F657B7DE |
|
|
JCSICA： D3342FDDF84C99DE843F051DB9D9F440D9C08BB1 |
|
| subjectKeyIdentifier (extnId :== 2 5 29 14，critical :== FALSE) | Subject Key Identifier | |
| SubjectKeyIdentifier | The identifier for the public key | |
|
type: OCTET STRING | CA11 B94942CCDDD7429F7DA18FE3B608F5C9BA265596 |
|
JCSICA 6C79367B36C0E483A2EBCF00A28455A040875122 |
|
|
||
| version | value | |
|---|---|---|
| Version | Version of the encoded certificate | |
|
2 (Ver.3) | |
| serialNumber | value | |
| CertificateSerialNumber | Serial number of certificate | |
|
*Serial number of certificate (unique positive integer) | |
| signature | value | |
| AlgorithmIdentifier | TThe identifier for the signature algorithm used by the CA to sign this certificate | |
|
Object ID for the signature algorithm | *One of the following values: |
|
RCA12, EVCA7, and SSCA7: 1.2.840.113549.1.1.11 (sha256WithRSAEncryption) |
|
RCA14, and EVCA9: 1.2.840.113549.1.1.12 (sha384WithRSAEncryption) |
||
RCA15, EVCA8, and SSCA8: 1.2.840.10045.4.3.3 (ecdsa-with-SHA384) |
||
|
Parameters of signature algorithm | *Only for RCA12, RCA14, EVCA7, EVCA9, and SSCA7 |
|
NULL | |
| issuer | value | |
| countryName | Country name attribute of certificate issuer | |
|
Object ID for the country name | |
|
2.5.4.6 | |
|
Value of country name | |
|
JP | |
| organizationName | Organization name attribute of certificate issuer | |
|
Object ID for organization name | |
|
2.5.4.10 | |
|
Value of organization name | |
|
Cybertrust Japan Co., Ltd. | |
| commonName | Common name attribute of certificate issuer | |
|
Object ID for common name | |
|
2.5.4.3 | |
|
Value of common name | *One of the following values: |
|
RCA12: SecureSign Root CA12 |
|
RCA14: SecureSign Root CA14 |
||
RCA15: SecureSign Root CA15 |
||
EVCA7: Cybertrust Japan SureServer EV CA G7 |
||
EVCA8: Cybertrust Japan SureServer EV CA G8 |
||
EVCA9: Cybertrust Japan SureServer EV CA G9 |
||
SSCA7: Cybertrust Japan SureServer CA G7 |
||
SSCA8: Cybertrust Japan SureServer CA G8 |
||
| validity | value | |
| Validity | Validity period of certificate | |
|
The date on which the certificate validity period begins | |
|
*The date on which the certificate validity period begins | |
|
The date on which the certificate validity period ends | |
|
*The date on which the certificate validity period ends | |
| subject | value | |
| countryName | Country name attribute of certificate subject | |
|
Object ID for the country name | |
|
2.5.4.6 | |
|
Value of country name | |
|
JP | |
| organizationName | Organization name attribute of certificate subject | |
|
Object ID for organization name | |
|
2.5.4.10 | |
|
Value of organization name | |
|
Cybertrust Japan Co., Ltd. | |
| commonName | Common name attribute of certificate subject | |
|
Object ID for common name | |
|
2.5.4.3 | |
|
Value of common name | *One of the following values: |
|
RCA12: SecureSign Root CA12 OCSP Responder |
|
RCA14: SecureSign Root CA14 OCSP Responder |
||
RCA15: SecureSign Root CA15 OCSP Responder |
||
EVCA7: Cybertrust Japan SureServer EV CA G7 OCSP Responder |
||
EVCA8: Cybertrust Japan SureServer EV CA G8 OCSP Responder |
||
EVCA9: Cybertrust Japan SureServer EV CA G9 OCSP Responder |
||
SSCA7: Cybertrust Japan SureServer CA G7 OCSP Responder |
||
SSCA8: Cybertrust Japan SureServer CA G8 OCSP Responder |
||
| subjectPublicKeyInfo | value | |
| SubjectPublicKeyInfo | Subject’s public key information | |
|
The identifier for cryptographic algorithm | |
|
Object ID for the cryptographic algorithm | *One of the following values: |
|
RCA12, RCA14, EVCA7, EVCA9, and SSCA7: 1.2.840.113549.1.1.1 (rsaEncryption) |
|
RCA15, EVCA8, and SSCA8: 1.2.840.10045.2.1 (id-ecPublicKey) |
||
|
Parameters of cryptographic algorithm | *One of the following values: |
|
RCA12, RCA14, EVCA7, EVCA9, and SSCA7: NULL |
|
RCA15, EVCA8, and SSCA8: 1.3.132.0.34 (secp384r1) |
||
|
Value of public key | *One of the following values: |
|
RCA12, EVCA7, and SSCA7: *Public key of 2048 bit size |
|
RCA14, and EVCA9: *Public key of 4096 bit size |
||
RCA15, EVCA8, and SSCA8: *Public key of 384 bit size |
||
| basicConstraints (extnId :== 2 5 29 19, critical :== TRUE) | value | |
|---|---|---|
| BasicConstraints | Basic Constraints | |
|
The flag to determine whether the supplied certificate is associated with a CA or an end entity | |
|
FALSE | |
| ocspNoCheck (extnId :== 1 3 6 1 5 5 7 48 1 5, critical :== FALSE) | value | |
| OCSPNoCheck | Revocation checking of signer certificates | |
| Do not check revocation | NULL | |
| keyUsage (extnId :== 2 5 29 15, critical :== TRUE) | value | |
| KeyUsage | Key Usage | |
|
10000000 (0x80) (digitalSignature) |
|
| extKeyUsage (extnId :== 2 5 29 37, critical :== FALSE) | value | |
| ExtKeyUsage | Extended Key Usage | |
|
The purpose of the key contained in the certificate | |
|
1.3.6.1.5.5.7.3.9 (OCSPSigning) | |
| authorityKeyIdentifier (extnId :== 2 5 29 35, critical :== FALSE) | value | |
| AuthorityKeyIdentifier | Authority Key Identifier | |
|
The identifier for public key | *One of the following values: |
|
RCA12: 5734F374CF044BD525E6F140B62C4CD92DE9A0AD |
|
RCA14: 0693A30A5E286937AA611DEBEBFC2D6F23E4F3A0 |
||
RCA15: EB41C8AEFCD59E5148F5BD8BF4872093412BD3F4 |
||
EVCA7: 7483319BF875CD0DCF8E84E6D28E9AA6794C2AA6 |
||
EVCA8: AEE4FDC16E22F8DFB71383F8E2D143B696B93AC8 |
||
EVCA9: EDB8FA2F3D7D25BEE354B165CE54A8833B92F0C7 |
||
SSCA7: 8E3C286393A4E4850F5489DD69B23C52674AB5A4 |
||
SSCA8: 3DD29719E5391699EE6BB01B7AC6F3FACAF5F703 |
||
| subjectKeyIdentifier (extnId :==2 5 29 14,, critical :== FALSE) | value | |
| SubjectKeyIdentifier | Subject Key Identifier | |
|
The identifier for public key | |
|
*Hash value of the BIT STRING subjectPublicKey | |
| version | value | |
|---|---|---|
| Version | Version of the encoded certificate | |
|
2 (Ver.3) | |
| serialNumber | value | |
| CertificateSerialNumber | Serial number of certificate | |
|
*Serial number of certificate (unique positive integer) | |
| signature | value | |
| AlgorithmIdentifier | TThe identifier for the signature algorithm used by the CA to sign this certificate | |
|
Object ID for the signature algorithm | |
|
1.2.840.113549.1.1.11 ( sha256WithRSAEncryption) | |
|
Parameters of signature algorithm | |
|
NULL | |
| issuer | value | |
| countryName | Country name attribute of certificate issuer | |
|
Object ID for the country name | |
|
2.5.4.6 | |
|
Value of country name | |
|
JP | |
| organizationName | Organization name attribute of certificate issuer | |
|
Object ID for the organization name | |
|
2.5.4.10 | |
|
Value of organization name | |
|
Cybertrust Japan Co.,Ltd. | |
| commonName | Common name attribute of certificate issuer | |
|
Object ID for the common name | |
|
2.5.4.3 | |
|
Value of common name | |
|
JCSI TLSSign Public CA | |
| validity | value | |
| Validity | Validity period of certificate | |
|
The date on which the certificate validity period begins | |
|
*The date and time on which the certificate validity period begins | |
|
The date on which the certificate validity period ends | |
|
*The date and time on which the certificate validity period ends | |
| subject | value | |
| countryName | Validated country name attribute of certificate subject | |
|
Object ID for the country name | |
|
2.5.4.6 | |
|
Value of country name | |
|
JP | |
| stateOrProvinceName | Validated state or Province name attribute of certificate subject | |
|
Object ID for the state or province name | |
|
2.5.4.8 | |
|
value of state or province name | |
|
*State or province name attribute of certificate subject | |
| localityName | Validated locality name attribute of certificate subject | |
|
Object ID for the locality name | |
|
2.5.4.7 | |
|
Value of locality name | |
|
*Locality name attribute of certificate subject | |
| organizationName | Organization name attribute of certificate issuer | |
|
Object ID for the organization name | |
|
2.5.4.10 | |
|
Value of organization name | |
|
*Organization name attribute of certificate subject | |
| commonName | Common name attribute of certificate issuer | |
|
Object ID for the common name | |
|
2 5 4 3 | |
|
Value of common name | |
|
* Common name attribute of certificate issuer * FQDN of the SSL/TLS server |
|
| * Note: domain: managedpki.ne.jp | ||
| subjectPublicKeyInfo | value | |
| SubjectPublicKeyInfo | Subject’s public key information | |
|
The identifier for the cryptographic algorithm | |
|
Object ID for the cryptographic algorithm | |
|
1.2.840.113549.1.1.1 (rsaEncryption) | |
|
Parameters of cryptographic algorithm | |
|
NULL | |
|
Value of public key | |
|
*The key size is depended on application | |
| *The key size must be at least 2048 bit | ||
| basicConstraints (extnId :== 2 5 29 19，critical :== TRUE) | value | |
|---|---|---|
| BasicConstraints | Basic Constraints | |
|
The flag to determine whether the supplied certificate is associated with a CA or an end entity | |
|
FALSE | |
| certificatePolicies (extnId :== 2 5 29 32，critical :== FALSE) | value | |
| PolicyInformation | Information of the Policy | |
|
Object ID for the Policy | |
|
1.2.392.200081.1.10.10 | |
|
Information of the policy qualifiers | |
|
Classification of policy qualifiers | |
|
1.3.6.1.5.5.7.2.1 (CPSuri) | |
|
URI of CPS is published | |
|
https://www.cybertrust.ne.jp/ssl/repository_rt/ | |
| PolicyInformation | Information of the Policy | |
|
Object ID for the Policy | |
|
2.23.140.1.2.2 | |
| subjectAltName (extnId :==2 5 29 17，critical :== FALSE) | value | |
| SubjectAltName | Subject Alternative Name | |
|
dnsName | |
|
* FQDN of the SSL/TLS server * Note: Domain: .managedpki.ne.jp |
|
| authorityInfoAccess (extnId :== 1 3 6 1 5 5 7 1 1，critical :== FALSE) | value | |
| AuthorityInfoAccess | Authority Information Access | |
|
Online Certificate Status Protocol | |
|
Access method | |
|
1.3.6.1.5.5.7.48.1 (ocsp) | |
|
Access location | |
|
http://jcsitlssignpublicca-ocsp. managedpki.ne.jp/OcspServer |
|
|
Issuer of the Authority | |
|
Access method | |
|
1.3.6.1.5.5.7.48.2 (caIssuers) | |
|
Access location | |
|
http://rtcrl.managedpki.ne.jp/ SecureSignAD/JCSITLSSignPublicCA/SSAD-JCSITLS.crt |
|
| keyUsage (extnId :== 2 5 29 15，critical :== TRUE) | value | |
| KeyUsage | Key Usage | |
|
10100000 (0xa0) (digitalSignature,keyEncipherment) |
|
| extKeyUsage (extnId :==2 5 29 37，critical :== FALSE) | value | |
| ExtKeyUsage | Extended Key Usage | |
| KeyPurposeId | The purpose of the key contained in the certificate | |
|
1.3.6.1.5.5.7.3.1 (serverAuth) 1.3.6.1.5.5.7.3.2 (clientAuth) |
|
| authorityKeyIdentifier (extnId :== 2 5 29 35，critical :== FALSE) | value | |
| AuthorityKeyIdentifier | Authority Key Identifier | |
|
The identifier for public key | |
|
D3342FDDF84C99DE843F051DB9D9F440D9C08BB1 | |
| cRLDistributionPoints (extnId :== 2 5 29 31，critical :== FALSE) | value | |
| cRLDistributionPoints | CRL Distribution Point | |
| DistributionPoint | CRL Distribution Point | |
| uniformResourceIdentifier | URI of CRL Distribution Point | |
|
http://rtcrl.managedpki.ne.jp/ SecureSignAD/JCSITLSSign PublicCA/cdp.crl |
|
| subjectKeyIdentifier (extnId :== 2 5 29 14，critical :== FALSE) | value | |
| SubjectKeyIdentifier | Subject Key Identifier（Based on RFC 5280, Section 4.2.1.2） | |
|
The identifier for the public key | |
|
* Hash value of subjectPublicKey | |
|
SecureSignPublicCA11 |
|---|---|
|
3 |
|
April 9, 2009 to April 8, 2029 |
|
8D4E255F55392AB219D20A958D6591A42D284596 |
|
D0D672C2547D574AE055D9E78A993DDBCC74044C4253FBFACA573A67D368E1DB |
|
February 17, 2020 06:04:53 (UTC) |
|
Cessation of operation |
|
SecureSign RootCA11 (JCSI Root CA) |
|
JCSI TLSSign Public CA |
|---|---|
|
1D0E228D02254C1A492974D4A3481E279008E152 |
|
September 11, 2018 to April 8, 2029 |
|
78765DC77359B2811B6D29FFD8AF8FF960668D26 |
|
C10FBC46B289E81FAD197DDC7A61482A9846D064BEE84E3C2A7F5DAC2E3894EA |
|
October 11, 2018 01:50:33 (UTC) |
|
Superseded |
|
SecureSign RootCA11 (JCSI Root CA) |