certification practice statement · 6.0 february 27, 2012 changed url of “2.2 information to be...

CPS (Certification Practice Statement) Version 8.2

© 2009 Cybertrust Japan Co., Ltd.

Certification Practice Statement Version 8.2

Cybertrust Japan Co., Ltd.


© 2009 Cybertrust Japan Co., Ltd. 1

Revision History

Version Date Reason for Revision

5.4 April 15, 2009

▪ Completely revised to comply with RFC 3647 ▪ Reviewed legal matters, and followed the “Extended Validation

Certificate Certification Practice Statement” (excluding provisions

that are applied only to the SureServer EV Certificate)

5.5 April 5, 2010 ▪ Added Cybertrust Japan Public CA G1 and Cybertrust Japan Public

CA G2 as certification authorities

5.6 July 1, 2010 ▪ Added description regarding sole proprietors

5.7 February 18, 2011

▪ Changed “5.1 Physical Security Controls” and “6.2.6 Private Key Transfer” in relation to remote storage locations

▪ Changed “5.1.9 Backup Site” pursuant to change of name of remote storage location to backup site

5.8 September 30, 2011

▪ Changes made pursuant to addition of certificate of Cybertrust Japan Public CA G2

▪ Included description of Serial Number of Certification Authority Certificate in “1.1 Overview”

▪ Changed “5.4.3 Audit Log Archival Period”

5.9 January 14, 2012 ▪ Changes made pursuant to addition of SubjectAltName extension

6.0 February 27, 2012

▪ Changed URL of “2.2 Information to be Published” ▪ Changed “6.3.2 Valid Term of Key Pair” ▪ Changed Policies extension of SureServer Certificates in “Appendix

B”

6.1 June 29, 2012

▪ Added “Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates” as requirements in “1.1 Overview”

▪ Changed items to be screened in “1.4.1.1 SureServer Certificate” and “1.4.1.2 SureMail Certificate”

▪ Changed meaning of Organization Unit (OU) in “3.1.2.1 SureServer Certificate”

▪ Changed license of domain name to license of FQDN in “3.2.2.1 SureServer Certificate”

▪ Changed “4.1.1 Persons Who May Apply for Certificates” ▪ Changed “4.9.1.1 Reason of Revocation by Subscriber” ▪ Changed “4.9.1.2 Reason of Revocation by Certification Authority” ▪ Changed “5.4.3 Audit Log Archival Period” ▪ Changed “5.5.2 Record Archival Period” ▪ Changed “6.3.2 Valid Term of Key Pair” ▪ Changed “9.6.3 Representations and Warranties of Subscribers” ▪ Added Baseline Requirements for the Issuance and Management of

Publicly-Trusted Certificates” and “Fully-Qualified Domain Name

(FQDN)” to “Appendix A”

6.2 November 14, 2012 ▪ Changed “6.1.1 Generation of Key Pair”

6.3 December 19, 2012 ▪ Made revision pursuant to start of operation of OCSP server

6.4 February 20, 2013 ▪ Changed SHA1” in “Appendix A” to “SHA1/SHA2” ▪ Added SureServer[SHA-2] certificate profile to “Appendix B”

6.5 May 1, 2013 ▪ Changed “4.6 Certificate Renewal Not Involving Rekey”

6.6 June 24, 2013 ▪ Changed certificate profile associated with issuance of Japanese

(UTF8String) of the certificate DN information in “Appendix B”

6.7 August 2, 2013 ▪ Added Cybertrust Japan Public CA G3 as a certification authority

6.8 November 15, 2013 ▪ Made changes pursuant to termination of Cybertrust Japan Public

CA, which is a certification authority of an older generation

6.9 January 6, 2014

▪ Made changes pursuant to the end of operation of Cybertrust Japan Public CA G1

▪ Made other corrections of descriptions and errors

7.0 April 14, 2014 ▪ Made changes pursuant to the renewal of certificate of Cybertrust

Japan Public CA G3




7.1 July 1, 2014 ▪ Change name of building of contact address ▪ Corrected typographical errors

7.2 February 2, 2015

▪ Added profile to “Appendix B” pursuant to dealing with Certificate Transparency


7.3 February 9, 2015

▪ Changed “3.3.2 Identification and Authentication for Renewal of Key (Certificate) after Revocation”

▪ Corrected error in reference numbers

7.4 March 30, 2015 ▪ Added “4.2.4 CAA Record (Certification Authority Authorization

Record) Procedures”

7.5 August 29, 2015 ▪ Made changes pursuant to the period for accepting of renewal

request

7.6 June 29, 2016

▪ Changed Business Days in "1.5.2 Contact Point" ▪ Changed keyUsage of SureServer [SHA-2] Certificates (Cybertrust

Japan Public CA G3) in "Appendix B" to TRUE

▪ Made other corrections of descriptions

7.7 November 2, 2016

▪ SureMail Certificate Term in "6.3.2 Valid Term of Key Pair" has been changed to "less than 39 months"

▪ Made other corrections of descriptions

7.8 March 4, 2017

▪ Made changes pursuant to the renewal of certificate of Cybertrust Japan Public CA G3

▪ Removed the annotations on CT certificate in "Appendix B" ▪ Made other corrections of descriptions

7.9 April 28, 2017

▪ Made changes pursuant to the values that cannot be specified for the review of the Organization Unit (OU)

▪ "1.4.1.1 SureServer Certificate (iii)" ▪ Meaning of Organization Unit (OU) in DN section of “3.1.2.1

SureServer Certificate” and “3.1.2.2 SureMail Certificate”

▪ “4.9.1.1 Reason for Revocation by Subscriber (vi)” ▪ “4.9.1.2 Reason for Revocation by the Certification Authority (viii)” ▪ “9.6.3 Representations and Warranties of Subscribers (iv)”

8.0 May 21, 2017 ▪ Removed "User Notice" of "certificatePolicies" in "Appendix B"

8.1 September 3, 2017

▪ Changed “4.2.4 CAA Record (Certification Authority Authorization Record) Procedures”

▪ Removed Cybertrust Japan Public CA G2（0727238d）

8.2 October 19, 2017

To comply with BR V 1.5.2 (Ballot 190 Effective October 19, 2017),

changed the following

▪ Segmented “3.2.2 Verification of Subscribers” ▪ Moved “4.2.4 CAA Record (Certification Authority Authorization

Record) Procedures” to “3.2.2.8 CAA Record”



Contents

REVISION HISTORY .................................................................................................................................. 1

1. INTRODUCTION ................................................................................................................................... 8

1.1 OVERVIEW ............................................................................................................................................... 8 1.2 DOCUMENT NAME AND IDENTIFICATION .................................................................................................. 9 1.3 PKI PARTICIPANTS ................................................................................................................................ 10

1.3.1 Certification Authority ................................................................................................................... 10 1.3.2 Registration Authority ................................................................................................................... 10 1.3.3 Issuing Authority ............................................................................................................................ 10 1.3.4 Subscriber ....................................................................................................................................... 10 1.3.5 Relying Party .................................................................................................................................. 10 1.3.6 Other Participants .......................................................................................................................... 10

1.4 CERTIFICATE USAGE ............................................................................................................................. 10 1.4.1 Types of Certificates ....................................................................................................................... 10 1.4.2 Appropriate Certificate Uses ......................................................................................................... 11 1.4.3 Prohibited Certificate Uses ............................................................................................................ 12

1.5 POLICY ADMINISTRATION ...................................................................................................................... 12 1.5.1 Organization Administering Documents ....................................................................................... 12 1.5.2 Contact Point .................................................................................................................................. 12 1.5.3 Party to Determine Suitability of CPS .......................................................................................... 12 1.5.4 Suitability Approval Procedures .................................................................................................... 12

1.6 DEFINITIONS AND ACRONYMS ................................................................................................................ 12

2. PUBLICATION AND REPOSITORY RESPONSIBILITIES ................................................................. 13

2.1 ORGANIZATION TO CONTROL REPOSITORIES .......................................................................................... 13 2.2 INFORMATION TO BE PUBLISHED ........................................................................................................... 13 2.3 TIMING AND FREQUENCY OF PUBLICATION ............................................................................................ 13 2.4 ACCESS CONTROL ON REPOSITORIES ..................................................................................................... 13

3. IDENTIFICATION AND AUTHENTICATION .................................................................................... 14

3.1 NAMING ................................................................................................................................................ 14 3.1.1 Types of Names ............................................................................................................................... 14 3.1.2 Need for Names to be Meaningful ................................................................................................. 14 3.1.3 Requirements for Anonymity or Pseudonymity of Subscribers .................................................... 15 3.1.4 Rules for Interpreting Various Name Forms ................................................................................ 15 3.1.5 Uniqueness of Names ..................................................................................................................... 15 3.1.6 Recognition, Authentication, and Role of Trademarks ................................................................. 15

3.2 INITIAL IDENTITY VALIDATION .............................................................................................................. 15 3.2.1 Method to Prove Possession of Private Key................................................................................... 15 3.2.2 Verification of Subscribers ............................................................................................................. 15 3.2.3 Authentication of Individual Identity ............................................................................................ 21 3.2.4 Non-verified Subscriber Information ............................................................................................. 21 3.2.5 Verification of Application Supervisor ........................................................................................... 21 3.2.6 Interoperability Standards ............................................................................................................. 21

3.3 IDENTIFICATION AND AUTHENTICATION FOR KEY (CERTIFICATE) RENEWAL REQUEST ........................... 22 3.3.1 Identification and Authentication upon Renewal for Routine Key (Certificate) Renewal .......... 22 3.3.2 Identification and Authentication for Renewal of Key (Certificate) after Revocation ................ 22

3.4 IDENTITY VALIDATION AND AUTHENTICATION UPON REVOCATION REQUEST ......................................... 22

4. CERTIFICATE LIFE-CYCLE OPERATIONAL REQUIREMENTS ..................................................... 23

4.1 CERTIFICATE APPLICATION ................................................................................................................... 23 4.1.1 Persons Who May Apply for Certificates ....................................................................................... 23 4.1.2 Enrollment Process and Responsibilities ...................................................................................... 23

4.2 CERTIFICATE APPLICATION PROCESSING ............................................................................................... 23 4.2.1 Identity Validation and Execution of Certification Operations ................................................... 23 4.2.2 Approval or Rejection of Certificate Application ........................................................................... 23 4.2.3 Time Required for Certificate Application Procedures ................................................................. 24

4.3 CERTIFICATE ISSUANCE ......................................................................................................................... 24 4.3.1 Certificate Issuance Procedures by Certification Authority ......................................................... 24 4.3.2 Notification of Issuance of Certificate to Subscribers ................................................................... 24

4.4 CERTIFICATE ACCEPTANCE ................................................................................................................... 25 4.4.1 Certificate Acceptance Verification Procedures ............................................................................ 25



4.4.2 Publication of Certificate by Certification Authority .................................................................... 25 4.4.3 Notification of Issuance of Certificate by Certification Authority to Other Participants ........... 25

4.5 KEY PAIR AND CERTIFICATE USAGE ...................................................................................................... 25 4.5.1 Use of Private Key and Certificate by Subscriber ......................................................................... 25 4.5.2 Use of Subscriber's Public Key and Certificate by Relying Party ................................................ 26

4.6 CERTIFICATE RENEWAL NOT INVOLVING REKEY ................................................................................... 26 4.6.1 Requirements for Certificate Renewal Not Involving Kew Renewal ........................................... 26 4.6.2 Persons Who May Request Renewal .............................................................................................. 26 4.6.3 Renewal Request Procedures ......................................................................................................... 26 4.6.4 Notification of Issuance of Renewed Certificate............................................................................ 26 4.6.5 Procedures for Accepting Renewed Certificate ............................................................................. 26 4.6.6 Publication of Renewed Certificate ................................................................................................ 27 4.6.7 Notification of Issuance of Certificate by Certification Authority to Other Participants ........... 27

4.7 CERTIFICATE RENEWAL INVOLVING REKEY ........................................................................................... 27 4.7.1 Requirements for Certificate Renewal Involving Rekey ............................................................... 27 4.7.2 Persons Who May Request Renewal .............................................................................................. 27 4.7.3 Rekey Application Procedures ....................................................................................................... 27 4.7.4 Notification of Issuance of Rekeyed Certificate ............................................................................ 27 4.7.5 Procedures for Accepting Rekeyed Certificate .............................................................................. 28 4.7.6 Publication of Rekeyed Certificate ................................................................................................. 28 4.7.7 Notification of Issuance of Rekeyed Certificate to Other Participants ........................................ 28

4.8 MODIFICATION OF CERTIFICATE ............................................................................................................ 28 4.8.1 Requirements for Modification of Certificate ................................................................................ 28 4.8.2 Persons Who May Request Modification of Certificate ................................................................. 28 4.8.3 Certificate Modification Procedures .............................................................................................. 28 4.8.4 Notification of Issuance of Modified Certificate ............................................................................ 28 4.8.5 Procedures for Accepting Modified Certificate .............................................................................. 29 4.8.6 Publication of Modified Certificate ................................................................................................ 29 4.8.7 Notification of Issuance of Modified Certificate to Other Participants ........................................ 29

4.9 CERTIFICATE REVOCATION AND SUSPENSION ........................................................................................ 29 4.9.1 Revocation Requirements ............................................................................................................... 29 4.9.2 Persons Who May Request Revocation .......................................................................................... 30 4.9.3 Revocation Request Procedures ..................................................................................................... 31 4.9.4 Grace Period up to Revocation Request ......................................................................................... 31 4.9.5 Time Required for Certification Authority to Process Revocation ............................................... 31 4.9.6 Verification of Revocation by Relying Parties ............................................................................... 31 4.9.7 CRL Issue Cycle .............................................................................................................................. 32 4.9.8 Maximum Delay Time up to CRL Issue ........................................................................................ 32 4.9.9 Online Verification of Revocation Information ............................................................................. 32 4.9.10 Online Verification of Certificate Status ....................................................................................... 32 4.9.11 Means for Providing Other Available Revocation Information .................................................... 32 4.9.12 Special Requirements for Compromise of Key .............................................................................. 32 4.9.13 Certificate Suspension Requirements ........................................................................................... 32 4.9.14 Persons Who May Request Suspension ......................................................................................... 33 4.9.15 Suspension Application Procedures ............................................................................................... 33 4.9.16 Term of Suspension ........................................................................................................................ 33

4.10 CERTIFICATE STATUS SERVICES ............................................................................................................ 33 4.10.1 Operational Features ..................................................................................................................... 33 4.10.2 Service Level ................................................................................................................................... 33 4.10.3 Other Requirements ....................................................................................................................... 33

4.11 END OF SUBSCRIPTION (REGISTRATION) ................................................................................................ 33 4.12 THIRD PARTY DEPOSIT OF KEY AND KEY RECOVERY.............................................................................. 33

4.12.1 Policy and Procedures for Key Deposit and Key Recovery ........................................................... 33 4.12.2 Policy and Procedures for Capsulization and Recovery of Session Key ....................................... 33

5. MANAGEMENT, OPERATIONAL, AND PHYSICAL CONTROLS ..................................................... 34

5.1 PHYSICAL SECURITY CONTROLS ............................................................................................................ 34 5.1.1 Site Location and Structure ........................................................................................................... 34 5.1.2 Physical Access ............................................................................................................................... 34 5.1.3 Power and Air-conditioning Equipment ........................................................................................ 34 5.1.4 Flood Control Measures ................................................................................................................. 34 5.1.5 Fire Control Measures .................................................................................................................... 34 5.1.6 Anti-earthquake Measures............................................................................................................. 34 5.1.7 Medium Storage Site ...................................................................................................................... 34



5.1.8 Waste Disposal ............................................................................................................................... 34 5.1.9 Backup Site ..................................................................................................................................... 35

5.2 PROCEDURAL CONTROLS ....................................................................................................................... 35 5.2.1 Relied Roles and Personnel ............................................................................................................ 35 5.2.2 Number of Personnel Required for Each Role ............................................................................... 35 5.2.3 Personal Identification and Validation of Each Role .................................................................... 35 5.2.4 Roles Requiring Segregation of Duties .......................................................................................... 36

5.3 PERSONNEL SECURITY CONTROLS ......................................................................................................... 36 5.3.1 Qualifications, Experience, Clearances ......................................................................................... 36 5.3.2 Background Checks and Clearance Procedures ............................................................................ 36 5.3.3 Training Requirements and Procedures ........................................................................................ 36 5.3.4 Retraining Period and Retraining Procedures .............................................................................. 36 5.3.5 Cycle and Order of Job Rotation .................................................................................................... 36 5.3.6 Sanction against Unauthorized Actions ........................................................................................ 36 5.3.7 Contract Requirements of Contract Employees ............................................................................ 36 5.3.8 Documents Available to Certification Authority Staff .................................................................. 37

5.4 AUDIT LOGGING PROCEDURES ............................................................................................................... 37 5.4.1 Types of Events to be Recorded...................................................................................................... 37 5.4.2 Audit Logging Frequency ............................................................................................................... 37 5.4.3 Audit Log Archival Period .............................................................................................................. 37 5.4.4 Audit Log Protection ....................................................................................................................... 37 5.4.5 Audit Log Backup Procedures ........................................................................................................ 37 5.4.6 Audit Log Collection System .......................................................................................................... 37 5.4.7 Notification to Parties .................................................................................................................... 37 5.4.8 Vulnerability Assessment .............................................................................................................. 37

5.5 RECORDS ARCHIVAL .............................................................................................................................. 38 5.5.1 Records to be Archived ................................................................................................................... 38 5.5.2 Record Archival Period ................................................................................................................... 38 5.5.3 Record Protection ............................................................................................................................ 38 5.5.4 Record Backup Procedures ............................................................................................................. 38 5.5.5 Time-stamping ................................................................................................................................ 38 5.5.6 Record Collecting System ............................................................................................................... 38 5.5.7 Record Acquisition and Validation Procedures ............................................................................. 38

5.6 KEY RENEWAL OF CERTIFICATION AUTHORITY ...................................................................................... 38 5.7 COMPROMISE AND DISASTER RECOVERY ................................................................................................ 39

5.7.1 Compromise and Disaster Recovery Procedures ........................................................................... 39 5.7.2 Procedures upon System Resource Failure ................................................................................... 39 5.7.3 Procedures upon Compromise of Subscriber's Private Key .......................................................... 39 5.7.4 Business Continuity upon Disasters ............................................................................................. 39

5.8 TERMINATION OF CERTIFICATION AUTHORITY OPERATIONS .................................................................. 39

6. TECHNICAL SECURITY CONTROLS................................................................................................. 40

6.1 KEY PAIR GENERATION AND INSTALLATION ........................................................................................... 40 6.1.1 Key Pair Generation ....................................................................................................................... 40 6.1.2 Delivery of Subscriber's Private Key ............................................................................................. 40 6.1.3 Delivery of Subscriber's Private Key to Certification Authority .................................................. 40 6.1.4 Delivery of Certification Authority Private Key to Relying Parties ............................................. 40 6.1.5 Key Length ...................................................................................................................................... 41 6.1.6 Public Key Parameter Generation and Inspection ....................................................................... 41 6.1.7 Key Usage ....................................................................................................................................... 41

6.2 PRIVATE KEY PROTECTION AND CRYPTOGRAPHIC MODULE ENGINEERING CONTROLS ........................... 42 6.2.1 Cryptographic Module Standards and Controls ........................................................................... 42 6.2.2 Private Key Controls by Multiple Persons .................................................................................... 42 6.2.3 Private Key Deposit ........................................................................................................................ 42 6.2.4 Private Key Backup ........................................................................................................................ 42 6.2.5 Private Key Archive ........................................................................................................................ 42 6.2.6 Private Key Transfer ...................................................................................................................... 42 6.2.7 Private Key Storage in Cryptographic Module ............................................................................. 42 6.2.8 Private Key Activation ................................................................................................................... 42 6.2.9 Private Key Non-activation ............................................................................................................ 42 6.2.10 Private Key Destruction ................................................................................................................. 43 6.2.11 Cryptographic Module Assessment ............................................................................................... 43

6.3 OTHER ASPECTS OF KEY PAIR MANAGEMENT ........................................................................................ 43 6.3.1 Storage of Public Key ..................................................................................................................... 43



6.3.2 Valid Term of Key Pair ................................................................................................................... 43 6.4 ACTIVATION DATA ................................................................................................................................. 43

6.4.1 Generation and Setting of Activation Data ................................................................................... 43 6.4.2 Activation Data Protection and Controls ...................................................................................... 43

6.5 COMPUTER SECURITY CONTROLS .......................................................................................................... 43 6.5.1 Technical Requirements of Computer Security............................................................................. 43 6.5.2 Computer Security Assessment ..................................................................................................... 44

6.6 LIFE CYCLE SECURITY CONTROLS ......................................................................................................... 44 6.6.1 System Development Controls ....................................................................................................... 44 6.6.2 Security Operation Controls .......................................................................................................... 44 6.6.3 Life Cycle Security Controls ........................................................................................................... 44

6.7 NETWORK SECURITY CONTROLS ............................................................................................................ 44 6.8 TIME-STAMPING .................................................................................................................................... 44

7. CERTIFICATE, CRL AND OCSP PROFILES ...................................................................................... 45

7.1 CERTIFICATE PROFILE ........................................................................................................................... 45 7.1.1 Version No. ...................................................................................................................................... 45 7.1.2 Certificate Extensions .................................................................................................................... 45 7.1.3 Algorithm Object Identifier ............................................................................................................ 45 7.1.4 Name Format .................................................................................................................................. 45 7.1.5 Name Restrictions .......................................................................................................................... 45 7.1.6 Certificate Policy Object Identifier ................................................................................................ 45 7.1.7 Use of Policy Constraint Extensions .............................................................................................. 45 7.1.8 Construction and Meaning of Policy Modifier ............................................................................... 45 7.1.9 Processing Method of Certificate Policy Extensions ..................................................................... 45

7.2 CRL PROFILE ........................................................................................................................................ 45 7.2.1 Version No. ...................................................................................................................................... 45 7.2.2 CRL, CRL Entry Extension ............................................................................................................ 45

7.3 OCSP PROFILE ..................................................................................................................................... 46 7.3.1 Version No. ...................................................................................................................................... 46 7.3.2 OCSP Extension ............................................................................................................................. 46

8. COMPLIANCE AUDIT AND OTHER ASSESSMENT ......................................................................... 47

8.1 AUDIT FREQUENCY AND REQUIREMENTS ............................................................................................... 47 8.2 AUDITOR REQUIREMENTS ...................................................................................................................... 47 8.3 RELATION OF AUDITOR AND AUDITEE .................................................................................................... 47 8.4 SCOPE OF AUDIT ................................................................................................................................... 47 8.5 MEASURES AGAINST IDENTIFIED MATTERS ............................................................................................ 47 8.6 DISCLOSURE OF AUDIT RESULTS ........................................................................................................... 47

9. OTHER BUSINESS AND LEGAL MATTERS ...................................................................................... 48

9.1 FEES ..................................................................................................................................................... 48 9.2 FINANCIAL RESPONSIBILITY .................................................................................................................. 48 9.3 CONFIDENTIALITY OF BUSINESS INFORMATION ..................................................................................... 48

9.3.1 Scope of Confidential Information ................................................................................................. 48 9.3.2 Information Outside Scope of Confidential Information .............................................................. 48 9.3.3 Responsibility of Protecting Confidential Information ................................................................. 49

9.4 PROTECTION OF PERSONAL INFORMATION ............................................................................................. 49 9.4.1 Privacy Policy.................................................................................................................................. 49 9.4.2 Information Handled as Personal Information ............................................................................. 49 9.4.3 Information not Deemed Personal Information ............................................................................ 49 9.4.4 Responsibility of Protecting Personal Information ....................................................................... 49 9.4.5 Notification to and Consent from Individuals on Use of Personal Information .......................... 49 9.4.6 Disclosure based on Judicial or Administrative Procedures ........................................................ 49 9.4.7 Other Cases of Information Disclosure .......................................................................................... 50

9.5 INTELLECTUAL PROPERTY RIGHTS ........................................................................................................ 50 9.6 REPRESENTATIONS AND WARRANTIES ................................................................................................... 50

9.6.1 Representations and Warranties of Issuing Authority ................................................................. 50 9.6.2 Representations and Warranties of Registration Authority ........................................................ 50 9.6.3 Representations and Warranties of Subscribers ........................................................................... 50 9.6.4 Representations and Warranties of Relying Parties ..................................................................... 51 9.6.5 Representations and Warranties of Other Participants ............................................................... 51

9.7 DISCLAIMERS OF WARRANTIES .............................................................................................................. 51 9.8 LIMITATIONS OF LIABILITY .................................................................................................................... 51



9.9 INDEMNITIES ......................................................................................................................................... 52 9.10 TERM OF DOCUMENT AND TERMINATION ............................................................................................... 52

9.10.1 Term of Document .......................................................................................................................... 52 9.10.2 Termination .................................................................................................................................... 52 9.10.3 Influence of Termination and Surviving Provisions ..................................................................... 52

9.11 INDIVIDUAL NOTIFICATIONS AND COMMUNICATIONS WITH PARTICIPANTS ............................................. 53 9.12 AMENDMENTS ....................................................................................................................................... 53

9.12.1 Amendment Procedures ................................................................................................................. 53 9.12.2 Notification Method and Period ..................................................................................................... 53 9.12.3 Modification of Object Identifier .................................................................................................... 53

9.13 DISPUTE RESOLUTION PROCEDURES ..................................................................................................... 53 9.14 GOVERNING LAW ................................................................................................................................... 53 9.15 COMPLIANCE WITH APPLICABLE LAW .................................................................................................... 53 9.16 MISCELLANEOUS PROVISIONS ............................................................................................................... 53

9.16.1 Entire Agreement ........................................................................................................................... 53 9.16.2 Assignment of Rights...................................................................................................................... 53 9.16.3 Severability ..................................................................................................................................... 53 9.16.4 Enforceability .................................................................................................................................. 54 9.16.5 Force Majeure ................................................................................................................................. 54

APPENDIX A: LIST OF DEFINITIONS .................................................................................................... 55

APPENDIX B: PROFILE OF CERTIFICATE ............................................................................................ 58



1. Introduction

1.1 Overview Cybertrust Japan Co., Ltd. ("Cybertrust") will issue SureServer Certificates and SureMail Certificates

(unless separately provided for herein, "certificate(s)").

The SureServer Certificate is an SSL server certificate for use in certifying servers and network devices

upon performing SSL/TLS communication.

The SureMail Certificate is a certificate for S/MIME signatures for use in certifying organizations

sending emails.

A subscriber's certificate is issued by the certificate authority operated by Cybertrust. Unless separately

provided for herein, the term "Certification Authority" as used herein shall include Cybertrust Japan

Public CA G3 and Cybertrust Japan Public CA G2.

The Certification Authority has been certified by the Root CA operated by DigiCert.

Name of Certification Authority Cybertrust Japan Public CA G3

Serial Number of Certification Authority

Certificate 054340d0a2c4cc8111faa8377d46e06f

Valid Term of Certification Authority Certificate November 15, 2016 to May 10, 2025

Signature System SHA2 with RSA

Key Length of Certification Authority 2048 bit

Certificates to be Issued to Subscriber SureServer Certificate

Root CA Baltimore CyberTrust Root



Certificate 0727a276

Valid Term of Certification Authority Certificate February 28, 2014 to June 10, 2020



Certificates to be Issued to Subscriber SureServer Certificate, SureMail Certificate




Certificate 07279ca5

Valid Term of Certification Authority Certificate January 23, 2014 to June 10, 2020









Certificate 07278728

Valid Term of Certification Authority Certificate May 9, 2013 to June 9, 2020







Certificate 07275c26

Valid Term of Certification Authority Certificate August 19, 2011 to August 10, 2018





The Certification Authority is compliant with the following rules and laws and ordinances in order to

issue certificates:

(i) Baseline Requirements Certificate Policy for the Issuance and Management of Publicly-Trusted Certificates;

(ii) Certification Practice Statement;

(iii) agreement concerning signature based on DigiCert's Root CA; and

(iv) laws of Japan that are applicable to the operations to be performed by the Certification Authority established in Japan.

The Certification Authority is compliant with the latest version of the Baseline Requirements

Certificate Policy for the Issuance and Management of Publicly-Trusted Certificates (the "BR")

published in http://www.cabforum.org. If there is any discrepancy between this "Certification Practice

Statement" (this "CPS") and the BR, the BR shall prevail.

This CPS prescribes the requirements for the Certification Authority to issue certificates. The

requirements include obligations of the Certification Authority, obligations of subscribers, and

obligations of relying parties.

Upon specifying the various requirements in this CPS, the Certification Authority shall adopt the

RFC3647 "Certificate Policy and Certification Practices Framework" set forth by the IETF PKIX

Working Group. RFC3647 is an international guideline that sets forth the framework of CPS or CP.

Matters that do not apply to the Certification Authority in the respective provisions of this CPS provided

based on the framework of RFC3647 will be indicated as "Not applicable".

The Certification Authority will not individually prescribe a policy for each subscriber certificate

("CP"), and this CPS shall include the respective CPs.

1.2 Document Name and Identification The official name of this CPS shall be the "Certification Practice Statement".



1.3 PKI Participants The PKI Participants described in this CPS are set forth below. Each of the relevant parties must observe

the obligations set forth in this CPS.

1.3.1 Certification Authority

The Certification Authority set forth in "1.1 Overview" of this CPS. The Certification Authority is

composed from an Issuing Authority and a Registration Authority. The Certification Authority shall be

governed by the Certification Authority Supervisor set forth in "5.2.1 Relied Roles and Personnel" of

this CPS, and approve this CPS.

1.3.2 Registration Authority

The Registration Authority is operated by Cybertrust, and accepts applications for certificates from

subscribers, and screens the applications based on this CPS. Based on the screening results, the

Registration Authority instructs the Issuing Authority to issue or revoke the certificates of subscribers,

or dismisses the applications.

1.3.3 Issuing Authority

The Issuing Authority is operated by Cybertrust, and issues or revokes certificates of subscribers based

on instructions from the Registration Authority. The Issuing Authority also controls the private key of

the Certification Authority based on this CPS.

1.3.4 Subscriber

A subscriber is an organization or a sole proprietor that applies for a certificate with the Certification

Authority, and uses the certificate based on this CPS and the subscriber agreement.

A person who is responsible for applying for a subscriber's certificate is referred to as an application

supervisor. A subscriber must appoint an application supervisor among persons affiliated with the

subscriber's organization.

Persons affiliated with the subscriber who may apply for a certificate with the Certification Authority

shall be limited to the application supervisor, or a procedural manager who is authorized by the

application supervisor to submit an application. The procedural manager may be appointed among

persons inside or outside the subscriber's organization. When the procedural manager is to be appointed

from the outside, the procedural manager may be an individual or an organization. The procedural

manager appointed among persons outside the subscriber's organization may be defined as the

"Applicant's Agent" in the subscriber agreement and other rules.

1.3.5 Relying Party

A relying party is an organization or an individual that verifies the validity of the certificates of the

Certification Authority and subscribers, and relies on the certificates the Certification Authority and

subscribers based on one's own judgment.

1.3.6 Other Participants

Not applicable.

1.4 Certificate Usage

1.4.1 Types of Certificates

The Certification Authority will issue the following certificates to subscribers.

(1) SureServer Certificate

The SureServer Certificate certifies a subscriber's server or network device, and realizes the SSL/TLS

encrypted communication between such server or network device and a relying party's client device.

Upon issuing a SureServer Certificate, the Registration Authority shall screen the following matters

based on this CPS:

(i) legal or physical existence of subscribers;



(ii) a subscriber has the right to use the Fully-Qualified Domain Name ("FQDN") included in the SureServer Certificate;

(iii) any of the following information is not included in the organizational unit (OU):

(a) FQDN;

(b) a value containing a character string that indicates the corporate status such as "CO.,

Ltd." or "Co. Ltd.";

(c) address (i.e., the value indicating a location);

(d) a name, company name, or trademark that belongs to other party but not to the

Applicant;

(e) symbols including a dot, hyphen, space, and the equivalent as well as a character string

consisting solely of spaces or combination of symbols and/or spaces; or,

(f) a character string to indicate "not applicable," "incomplete," "blank,” and the equivalent

indicated by "NULL," "unknown," or "N/A";

(iv) employment of an application supervisor;

(v) acceptance of the subscriber agreement;

(vi) approval of the application supervisor for the procedural manager to submit an application; and

(vii) high risk status, etc.*

*The following will be surveyed as the high risk status, etc.:

▪ past fishing cases; and

▪ records of applications that were dismissed or records of certificates that were revoked by the Certification Authority in the past due to suspicion of fishing and other

fraudulent acts.

If there is suspicion of fraudulent use of a certificate for which an application was submitted

with the Certification Authority based on the foregoing survey, the Certification Authority

shall perform additional screening that it deems appropriate as needed.

(2) SureMail Certificate

The SureMail Certificate certifies organizations sending emails, and realizes S/MIME signatures. Upon

issuing a SureMail Certificate, the Registration Authority shall survey the following matters based on

this CPS:

(i) legal or physical existence of subscribers;

(ii) a subscriber has the right to use the domain name included in the SureMail Certificate;

(iii) value described in "1.4.1(1) SureServer Certificate (iii)" in this CPS is not included in the organization unit (OU) of the certificate;

(iv) employment of application supervisor;

(v) acceptance of the subscriber agreement; and

(vi) approval of the application supervisor for the procedural manager to submit an application.

1.4.2 Appropriate Certificate Uses

Uses of a subscriber's certificate shall be as set forth below.


(i) Certification of devices (server, network device, etc.) in which the SureServer Certificate is to be used; and

(ii) SSL or TLS encrypted communication.


(i) Certification of organizations using the SureMail Certificate; and



(ii) S/MIME signature.

1.4.3 Prohibited Certificate Uses

The Certification Authority prohibits the use of certificates for any purpose other than as set forth in

"1.4.2 Appropriate Certificate Uses" of this CPS.

1.5 Policy Administration

1.5.1 Organization Administering Documents

This CPS and the subscriber agreement will be administered by the Certification Authority.

1.5.2 Contact Point

The Certification Authority will accept inquiries related to the services provided by Cybertrust and this

CPS at the following contact information.

Contact Information

Cybertrust Japan Co., Ltd. SureServer Section or SureMail Section

Address: 13F SE Sapporo Bldg., 1-1-2 Kita 7-jo Nishi, Kita-ku, Sapporo-shi 060-0807

Tel: 011-708-5283

Business Days: Monday to Friday (excluding national holidays and December 29 to January 4)

Business Hours: 9:00 to 18:00

Inquiries and complaints: As indicated below

Description Address

▪ Inquiries regarding the application process for issuance and technical inquiries

▪ Inquiries regarding revocation requests and application process

▪ Inquiries regarding problems with certificates or upon discovery of fraudulent

certificates

▪ Communication of other complaints

▪ Other inquiries regarding this CPS, etc.

SureServer: [email protected]

SureMail: [email protected]

1.5.3 Party to Determine Suitability of CPS

Certificates of the Certification Authority will be issued by the Root CA operated by DigiCert. In order

to receive the issuance of a certificate from the Root CA, this CPS must comply with the matters

requested by DigiCert. DigiCert will assess and determine the suitability of this CPS.

1.5.4 Suitability Approval Procedures

The suitability described in "1.5.3 Party to Determine Suitability of CPS" of this CPS shall go through

an external audit, and then be approved by DigiCert.

1.6 Definitions and Acronyms

As prescribed in Appendix A of this CPS.



2. Publication and Repository Responsibilities

2.1 Organization to Control Repositories Repositories of the Certification Authority will be controlled by Cybertrust.

2.2 Information to be Published The Certification Authority will publish the repositories as follows.

Publish the following information on https://www.cybertrust.ne.jp/ssl/repository/index.html:

▪ this CPS;

▪ subscriber agreement; and

▪ other terms and conditions regarding the services of the Certification Authority (the "Related

Rules")

Publish the following information on:

http://sureseries-crl.cybertrust.ne.jp/SureServer/ctjpubcag2/cdp.crl and

http://sureseries-crl.cybertrust.ne.jp/SureServer/ctjpubcag3/cdp.crl.

▪ Certificate revocation list ("CRL") of the SureServer Certificates issued by the Certification Authority


http://sureseries-crl.cybertrust.ne.jp/SureMail/ctjpubcag2/cdp.crl and

http://sureseries-crl.cybertrust.ne.jp/SureMail/ctjpubcag3/cdp.crl.

▪ CRL of the SureMail Certificates issued by the Certification Authority


https://www.cybertrust.ne.jp/sureserver/support/download_ca.html.

▪ Certificates of the Certification Authority

2.3 Timing and Frequency of Publication The timing and frequency of publication regarding the information to be published by the Certification

Authority shall be as follows; save for cases where repository maintenance or the like is required, but

CRL shall be published 24 hours:

(i) this CPS, the subscriber agreement, and the Related Rules shall be published each time they are amended;

(ii) this CRL shall be renewed according to the cycle prescribed in "4.9.7 CRL Issue Cycle" of this CPS and the published; and

(iii) the certificates of the Certification Authority shall be published at least during the effective period.

2.4 Access Control on Repositories The Certification Authority shall not perform special access control on the repositories.



3. Identification and Authentication

3.1 Naming

3.1.1 Types of Names

Subscribers will be identified based on the X.500 Distinguished Name ("DN") in the certificate.

3.1.2 Need for Names to be Meaningful

The name included in the DN of the certificate shall have the meaning of the subsequent paragraph.


DN Item Meaning

Common Name Complete host name of server or network device to use the certificate

Organization Name of organization of subscriber or name of sole proprietor

Organization Unit

*(voluntary item)

Business division, service, trade name (for sole proprietors), etc.

*Any of the values described in "1.4.1(1) SureServer Certificate (iii)" in

this CPS must not be included

Locality Address of business location or address of sole proprietor (locality)

State or Province Address of business location or address of sole proprietor (state or

province)

Country Address of business location or address of sole proprietor (country)


DN Item Meaning

Common Name

Name in which the values (text, numbers, symbols, etc.) on the left of @

of the email address to use the certificate are added to the subscriber's

name

Organization Same as “3.1.2(1) SureServer Certificate”

Organization Unit

*(voluntary item) Same as “3.1.2(1) SureServer Certificate”

Locality Same as “3.1.2(1) SureServer Certificate”

State or Province Same as “3.1.2(1) SureServer Certificate”

Country Same as “3.1.2(1) SureServer Certificate”



3.1.3 Requirements for Anonymity or Pseudonymity of Subscribers

Not applicable.

3.1.4 Rules for Interpreting Various Name Forms

Rules for interpreting the DN form of certificates issued by the Certification Authority shall be pursuant

to X.500.

3.1.5 Uniqueness of Names

The certificates issued by the Certification Authority can uniquely identify a subscriber based on the

DN.

3.1.6 Recognition, Authentication, and Role of Trademarks

The Certification Authority does not verify, via screening, the copyrights, trade secrets, trademark

rights, utility model rights, patent rights and other intellectual property rights (including, but not limited

to, rights for obtaining patents and other intellectual properties; simply "Intellectual Property Rights")

upon issuing a subscriber's certificate.

3.2 Initial Identity Validation

3.2.1 Method to Prove Possession of Private Key


A certificate issuance request ("CSR") which constitutes a part of the application information from a

subscriber includes a digital signature encrypted with a public key and a private key corresponding to

the public key.

The Certification Authority will verify the digital signature by using the public key included in the CSR

and thereby validate that the digital signature was signed using the subscriber's private key, and

determine that the subscriber is in possession of the private key.


The Certification Authority shall generate a subscriber's private key on behalf of the subscriber. As set

forth in "6.1.2(1) SureMail Certificate" of this CPS, ownership of the private key will be transferred

from the Certification Authority to the subscriber at the time that the Certification Authority delivers

the private key to the subscriber and the subscriber accepts the private key.

3.2.2 Verification of Subscribers

3.2.2.1 Identity


The Certification Authority shall screen and verify the matters set forth in "1.4.1(1) SureServer

Certificate" of this CPS.

Upon verifying the subscriber, the Certification Authority shall use public documents and data,

documents and data provided by a third party that is deemed reliable by the Certification Authority, or

documents and data provided by the subscriber, as well as make inquiries to an appropriate individual

affiliated with the subscriber or the organization configuring the subscriber. Moreover, the Certification

Authority shall visit the subscriber and conduct an on-site survey as needed.

However, when there are documents or data that were received from the subscriber or documents or

data that were independently obtained by the Certification Authority during the period that was posted

on the website by Cybertrust or the period notified to the subscriber, and such documents or data have

been screened by the Certification Authority, the Certification Authority shall not request the

resubmission of such documents or data.



Moreover, when a subscriber is to apply for a SureServer Certificate with a domain name owned by a

third party, the Certification Authority shall verify with the organization or individual that owns the

domain name regarding whether the FQDN has been licensed to the subscriber.

Details regarding the verification procedures to be requested to subscribers shall be posted on

Cybertrust's website or notified individually to the subscribers.


The Certification Authority shall screen and verify the matters set forth in "1.4.1(2) SureMail

Certificate" of this CPS. The provisions of "3.2.2.1(1) SureServer Certificate" of this CPS shall apply

correspondingly to the verification method.

3.2.2.2 DBA/Tradename


The Certification Authority does not allow DBA / Tradename to be included in subscriber's certificate.


The same as "3.2.2.2(1) SureServer Certificate" of this CPS.

3.2.2.3 Verification of Country

The Certification Authority confirms the Country included in the subscriber's certificate with this

CPS "3.2.2.1 Identity".

3.2.2.4 Validation of Domain Authorization or Control

The Certification Authority SHALL confirm that prior to issuance, the CA has validated each Fully‐Qualified Domain Name (FQDN) listed in the Certificate using at least one of the methods listed

below.

Completed validations of Applicant authority may be valid for the issuance of multiple Certificates

over time. In all cases, the validation must have been initiated within the time period specified in the

relevant requirement (such as Section 4.2.1 of BR) prior to Certificate issuance. For purposes of

domain validation, the term Applicant includes the Applicant's Parent Company, Subsidiary

Company.

The Certification Authority SHALL maintain a record of which domain validation method, including

relevant BR version number, they used to validate every domain.

Note: FQDNs may be listed in Subscriber Certificates using dNSNames in the subjectAltName

extension or in Subordinate CA Certificates via dNSNames in permittedSubtrees within the Name

Constraints extension.

3.2.2.4.1 Validating the Applicant as a Domain Contact


Confirming the Applicant's control over the FQDN by validating the Applicant is the Domain Contact

directly with the Domain Name Registrar. This method may only be used if:

(i) The Certification Authority the Applicant's identity under BR Section 3.2.2.1 and the authority of the Applicant Representative under BR Section 3.2.5, OR

(ii) The Certification Authority the Applicant's identity under EV Guidelines Section 11.2 and the agency of the Certificate Approver under EV Guidelines Section 11.8; OR

(iii) The Certification Authority is also the Domain Name Registrar, or an Affiliate of the Registrar, of the Base Domain Name.

Note: Once the FQDN has been validated using this method,the Certification Authority MAY also

issue Certificates for other FQDNs that end with all the labels of the validated FQDN. This method is

suitable for validating Wildcard Domain Names.




Confirming the Applicant's control over the FQDN by validating the Applicant is the Domain Contact

directly with the Domain Name Registrar.

Note: Once the FQDN has been validated using this method,the Certification Authority MAY also issue

Certificates for other FQDNs that end with all the labels of the validated FQDN.

3.2.2.4.2 Email, Fax, SMS, or Postal Mail to Domain Contact


Confirming the Applicant's control over the FQDN by sending a Random Value via email, fax, SMS,

or postal mail and then receiving a confirming response utilizing the Random Value. The Random

Value MUST be sent to an email address, fax/SMS number, or postal mail address identified as a Domain Contact.

Each email, fax, SMS, or postal mail MAY confirm control of multiple Authorization Domain

Names.

The Certification Authority MAY send the email, fax, SMS, or postal mail identified under this

section to more than one recipient provided that every recipient is identified by the Domain Name

Registrar as representing the Domain Name Registrant for every FQDN being verified using the

email, fax, SMS, or postal mail.

The Random Value SHALL be unique in each email, fax, SMS, or postal mail.

The Certification Authority MAY resend the email, fax, SMS, or postal mail in its entirety, including

re‐use of the Random Value, provided that the communication's entire contents and recipient(s) remain unchanged.

The Random Value SHALL remain valid for use in a confirming response for no more than 30 days

from its creation. The CPS MAY specify a shorter validity period for Random Values, in which casethe Certification Authority MUST follow its CPS.

Note: Once the FQDN has been validated using this method, the CA MAY also issue Certificates for

other FQDNs that end with all the labels of the validated FQDN. This method is suitable for

validating Wildcard Domain Names.



3.2.2.4.3 Phone Contact with Domain Contact


Confirming the Applicant's control over the FQDN by calling the Domain Name Registrant's phone

number and obtaining a response confirming the Applicant's request for validation of the FQDN. The

Certification Authority MUST place the call to a phone number identified by the Domain Name

Registrar as the Domain Contact.

Each phone call SHALL be made to a single number and MAY confirm control of multiple FQDNs,

provided that the phone number is identified by the Domain Registrar as a valid contact method for

every Base Domain Name being verified using the phone call.








3.2.2.4.4 Constructed Email to Domain Contact


Confirm the Applicant's control over the FQDN by (i) sending an email to one or more addresses

created by using 'admin', 'administrator', 'webmaster', 'hostmaster', or 'postmaster' as the local part,

followed by the atsign ("@"), followed by an Authorization Domain Name, (ii) including a Random

Value in the email, and (iii) receiving a confirming response utilizing the Random Value.

Each email MAY confirm control of multiple FQDNs, provided the Authorization Domain Name

used in the email is an Authorization Domain Name for each FQDN being confirmed

The Random Value SHALL be unique in each email.

The email MAY be re‐sent in its entirety, including the re‐use of the Random Value, provided that its entire contents and recipient SHALL remain unchanged.

The Random Value SHALL remain valid for use in a confirming response for no more than 30 days

from its creation. The CPS MAY specify a shorter validity period for Random Values.






3.2.2.4.5 Domain Authorization Document


Confirming the Applicant's control over the FQDN by relying upon the attestation to the authority of

the Applicant to request a Certificate contained in a Domain Authorization Document. The Domain

Authorization Document MUST substantiate that the communication came from the Domain Contact.

The Certification Authority MUST verify that the Domain Authorization Document was either (i)

dated on or after the date of the domain validation request or (ii) that the WHOIS data has not

materially changed since a previously provided Domain Authorization Document for the Domain

Name Space.



3.2.2.4.6 Agreed‐Upon Change to Website


Confirming the Applicant's control over the FQDN by confirming one of the following under the

"/.wellknown/pki‐validation" directory, or another path registered with IANA for the purpose of Domain Validation, on the Authorization Domain Name that is accessible bythe Certification

Authority via HTTP/HTTPS over an Authorized Port:

(i) The presence of Required Website Content contained in the content of a file. The entire Required Website Content MUST NOT appear in the request used to retrieve the file or web

page, or

(ii) The presence of the Request Token or Request Value contained in the content of a file where the Request Token or Random Value MUST NOT appear in the request.



If a Random Value is used,the Certification Authority SHALL provide a Random Value unique to the

certificate request and SHALL not use the Random Value after the longer of (i) 30 days or (ii) if the

Applicant submitted the Certificate request, the timeframe permitted for reuse of validated

information relevant to the Certificate (such as in Section 4.2.1 of BR or Section 11.14.3 of the EV

Guidelines).

This certification authority does not adopt Request Token.






3.2.2.4.7 DNS Change


Confirming the Applicant's control over the FQDN by confirming the presence of a Random Value or

Request Token for either in a DNS CNAME, TXT or CAA record for either 1) an Authorization

Domain Name; or 2) an Authorization Domain Name that is prefixed with a label that begins with an

underscore character.

If a Random Value is used,the Certification Authority SHALL provide a Random Value unique to the

Certificate request and SHALL not use the Random Value after (i) 30 days or (ii) if the Applicant

submitted the Certificate request, the timeframe permitted for reuse of validated information relevant

to the Certificate (such as in Section 3.3.1 of BR or Section 11.14.3 of the EV Guidelines).

This certification authority does not adopt Request Token.






3.2.2.4.8 IP Address


Confirming the Applicant's control over the FQDN by confirming that the Applicant controls an IP

address returned from a DNS lookup for A or AAAA records for the FQDN in accordance with

section 3.2.2.5.

Note: Once the FQDN has been validated using this method,the Certification Authority MAY NOT

also issue Certificates for other FQDNs that end with all the labels of the validated FQDN unless the

CA performs a separate validation for that FQDN using an authorized method. This method is NOT




3.2.2.4.9 Test Certificate

This certification authority does not adopt this method.

3.2.2.4.10 TLS Using a Random Number



This certification authority does not adopt this method.

3.2.2.5 Authentication for an IP Address


For each IP Address listed in a Certificate,the Certification Authority SHALL confirm that, as of the

date the Certificate was issued, the Applicant has control over the IP Address by:

(i) Having the Applicant demonstrate practical control over the IP Address by making an

agreed‐upon change to information found on an online Web page identified by a uniform resource identifier containing the IP Address;

(ii) Obtaining documentation of IP address assignment from the Internet Assigned Numbers Authority (IANA) or a Regional Internet Registry (RIPE, APNIC, ARIN, AfriNIC,

LACNIC);

(iii) Performing a reverse‐IP address lookup and then verifying control over the resulting Domain Name under Section 3.2.2.4; or

(iv) Using any other method of confirmation, provided that the CA maintains documented evidence that the method of confirmation establishes that the Applicant has control over the

IP Address to at least the same level of assurance as the methods previously described.

Note: IPAddresses may be listed in Subscriber Certificates using IPAddress in the subjectAltName

extension or in Subordinate CA Certificates via IPAddress in permittedSubtrees within the Name

Constraints extension.


Not applicable.

3.2.2.6 Wildcard Domain Validation


Before issuing a certificate with a wildcard character (*) in a CN or subjectAltName of type DNS‐ID,the Certification Authority MUST determines if the wildcard character occurs in the first label

position to the left of a “registry‐controlled” label or “public suffix” (e.g. “*.com”, “*.co.uk”, see RFC 6454 Section 8.2 for further explanation). Determination of registry control shall follow

practices as set forth in Section 3.2.2.6 of BR.

If a wildcard would fall within the label immediately to the left of a registry‐controlled† or public suffix,the Certification Authority MUST refuse issuance unless the applicant proves its rightful

control of the entire Domain Namespace.


Not applicable.

3.2.2.7 Data Source Accuracy


Prior to using any data source as a Reliable Data Source,the Certification Authority SHALL evaluate

the source for its reliability, accuracy, and resistance to alteration or falsification. The CA SHOULD

consider the following during its evaluation:

(i) The age of the information provided,

(ii) The frequency of updates to the information source,

(iii) The data provider and purpose of the data collection,

(iv) The public accessibility of the data availability, and

(v) The relative difficulty in falsifying or altering the data.



Databases maintained bythe Certification Authority, its owner, or its affiliated companies do not

qualify as a Reliable Data Source if the primary purpose of the database is to collect information for

the purpose of fulfilling the validation requirements under this Section 3.2.



3.2.2.8 CAA Record (Certification Authority Authorization Record) Procedures


The Certification Authority will verify the CAA Record defined in RFC6844（DNS Certification

Authority Authorization (CAA) Resource Record）.

If the CAA record (issue / issuewild) contains any of the following values,the Certification Authority

recognizeｓ that it is designated as a certificate authority that permits issuance of the certificates.

・cybertrust.ne.jp

・digicert.ne.jp

・digicert.com


Not applicable.

3.2.3 Authentication of Individual Identity

3.2.4 Non-verified Subscriber Information


This Certification Authority will not verify the truthfulness and accuracy of the information described

in the subscriber's organization unit (OU).


The same as "3.2.4(1) SureServer Certificate" of this CPS.

3.2.5 Verification of Application Supervisor


This Certification Authority shall verify the employment of the application supervisor and the authority

to submit an application on behalf of the subscriber. This Certification Authority shall additionally

verify that the application supervisor has accepted the subscriber agreement and approved the filing of

an application by the procedural manager by way of callback or means equivalent to callback. The

phone number to be used for the callback shall be a number provided by a third party or a number

included in the documents or data which were provided by the subscriber and have been deemed to be

reliable by this Certification Authority.



3.2.6 Interoperability Standards

Not applicable.



3.3 Identification and Authentication for Key (Certificate) Renewal Request

3.3.1 Identification and Authentication upon Renewal for Routine Key (Certificate) Renewal


The provisions of "3.2 Initial Identity Validation" of this CPS shall apply correspondingly.


The provisions of "3.2 Initial Identity Validation" of this CPS shall apply correspondingly.

3.3.2 Identification and Authentication for Renewal of Key (Certificate) after Revocation


To be performed based on the same procedures as "3.2 Initial Identity Validation" of this CPS.

However, when it is verified that the public key, certification information and expiration date included

in the CSR of the re-issuance application coincide with the certificate of the re-issuer, verification based

on "3.2 Initial Identity Validation" of this CPS will not be performed, and a certificate shall be issued

based on the verification of the foregoing coincidence.



3.4 Identity Validation and Authentication upon Revocation Request


When the Certification Authority receives a revocation request from a subscriber via email, the

Certification Authority shall verify the identity of the person who submitted the application, that such

person is authorized to submit an application, and the reason of revocation. As the verification method,

the Certification Authority shall compare the information notified to the Certification Authority upon

application for issuance of a SureServer Certificate and the information only known to the Certification

Authority and the subscriber.

Upon receiving a revocation request for a SureServer Certificate of a specific subscriber other than the

subscriber of that SureServer Certificate, the Certification Authority shall survey the reason of

revocation and verify with the subscriber.

When the reason for revocation in the revocation request from a subscriber or a party other than that

subscriber corresponds to a revocation event set forth in the subscriber agreement of the SureServer

Certificate, the Certification Authority shall revoke the SureServer Certificate upon notifying the

subscriber.

The email address to be used for the revocation request is indicated in "1.5.2 Contact Point" and

Cybertrust's website.


The provisions of "3.4(1) SureServer Certificate" of this CPS shall apply correspondingly.



4. Certificate Life-Cycle Operational Requirements

4.1 Certificate Application

4.1.1 Persons Who May Apply for Certificates


Persons who may apply for a SureServer Certificate with the Certification Authority shall only be the

application supervisor, or a procedural manager who was authorized by the application supervisor

submit an application.

Appointment of the application supervisor or the procedural manager shall be pursuant to the provisions

of "1.3.4 Subscriber" of this CPS.

The Certification Authority's verification of a subscriber's intent to submit an application shall be

answered by the application supervisor or a person affiliated with the subscriber who was authorized

by the application supervisor.


The provisions of "4.1.1(1) SureServer Certificate" of this CPS shall apply correspondingly.

4.1.2 Enrollment Process and Responsibilities


A subscriber shall apply for a SureServer Certificate upon accepting this CPS and the subscriber

agreement. Upon filing an application, a subscriber is responsible for providing true and accurate

information to the Certification Authority.

The method of applying for a certificate will be posted on Cybertrust's website. Moreover, the method

of applying for a SureServer Certificate based on SureHandsOn provided by Cybertrust will be posted

on its website or explained individually to subscribers.


A subscriber shall apply for a SureMail Certificate upon accepting this CPS and the subscriber

agreement. Upon filing an application, a subscriber is responsible for providing true and