トゥルービジネス規約
True BusinessID® and Enterprise SSL™
Certificate Practice Statement
TABLE of CONTENTS
I. INTRODUCTION
A. Overview
B. Definitions
C. Description and Use of Certificates
II. GENERAL PROVISIONS
A. Obligations
B. FeesC. Compliance Audit
D. Limited Warranty/Disclaimer
E. Limitation on Liability
F. Force Majeure
G. Financial Responsibility
H. Interpretation & Enforcement
I. Repository and CRL
J. Confidentiality Policy
K. Waiver
L. Survival
M. Export

トゥルービジネス規約
BusinessID Server Certificates and GeoTrust True BusinessID
Wildcard Certificates to enterprises that have enrolled in the service.
This CPS and any and all amendments thereto are incorporated byreference into all of the above-listed GeoTrust Certificates.
Internet service providers, hosting companies, or other businesses(“Partners”) may perform some functions relating to the issuance ofCertificates on behalf of Subscribers (e.g., the gathering of
Subscriber information, generating and forwarding of a Certificate
Signing Request, or installation and use of a Certificate following
issuance). In such event, the processes and procedures stated inthis CPS will be applied to the Partners as if they were theSubscribers as closely as practicable.
B. Definitions
For the purposes of this CPS, all capitalized terms used herein shallhave the meaning given to them in Section VIII, Definitions, orelsewhere in this CPS.
C. Description and Use of Certificates

III. OPERATIONAL REQUIREMENTS
A. Application Requirements
B. Certificate Information
C. Procedure for Processing Certificate Applications
D. Application Issues
E. Certificate Delivery
F. Certificate Acceptance
G. Certificate Renewal and Rekey
H. Certificate Expiration
I. Certificate Revocation
J. Certificate Suspension
K. Key Management
L. Subscriber Key Pair Generation
M. Records Archival
N. CATermination
IV. PHYSICAL SECURITY CONTROLS
A. Site Location and Construction
B. Physical Access Controls
C. Power and Air Conditioning
D. Water Exposures
E. Fire Prevention and Protection
F. Media Storage
G. Waste Disposal
H. Off-Site Backup
V. TECHNICAL SECURITY CONTROLS
A. CA Key Pair
B. Subscriber Key Pairs
C. Business Continuity Management Controls
D. Event Logging
VI. CERTIFICATE AND CRL PROFILE
A. Certificate Profile
B. CRL Profile
VII. CPS ADMINISTRATION
A. CPS Authority
B. Contact Person
C. CPS Change Procedures
VIII. DEFINITIONS
I. INTRODUCTION
A. Overview
This GeoTrust Certificate Practice Statement (the "CPS") presents theprinciples and procedures GeoTrust employs in the issuance and life
cycle management of GeoTrust True BusinessID® Server Certificatesand GeoTrust True BusinessID Wildcard Certificates. This CPS alsopresents the principles and procedures GeoTrust employs in its
Enterprise SSL™ service as a means of delivering GeoTrust True

Cyber Trading Co. https://yt.com/

ٛ .1. GeoTrust True BusinessID Server Certificatesٛ .GeoTrust True BusinessID Server Certificates are X.509 Certificateswith SSL Extensions that chain to GeoTrust’s Equifax Secure
Certificate Authority trusted root and which facilitate secure electroniccommerce by providing limited authentication of a Subscriber's server
and permitting SSL encrypted transactions between a Relying Party's
browser and the Subscriber's server. In addition, GeoTrust may alsoenable the Certificate for use as a client Certificate.
ٛ .2. GeoTrust True BusinessID Wildcard Certificatesٛ .GeoTrust True BusinessID Wildcard Certificates are X.509
Certificates with SSL Extensions that chain to GeoTrust’s Equifax
Secure Certificate Authority trusted root and that are vetted to a
specified level domain and may be used in connection with all nextlevel higher domains that contain the specified vetted level domain.
These certificates facilitate secure electronic commerce by providing
limited authentication of a Subscriber's server and permitting SSL
encrypted transactions between a Relying Party's browser and the
Subscriber's server.
2.
3. Operational Period of Certificates
GeoTrust Server True BusinessID Web Certificates and GeoTrust
True BusinessID Wildcard Certificates have an Operational Period of
one year, two years, or three years from the date of issuance(depending on whether the Subscriber has purchased a one year,
two year, or three year Certificate), unless another time period or
expiration date is specified on such Certificate, or unless theCertificate is revoked prior to the expiration of the Certificate’s
Operational Period.

If a Subscriber renews a Certificate within a specified period prior to
expiration of an existing Certificate, GeoTrust may extend the
Operational Period for the new Certificate by a specified number ofdays intended to give the Subscriber the approximate benefit of theremaining Operational Period of the existing Certificate. In addition,from time to time GeoTrust may extend the Operational Period of theCertificates it issues in connection with promotions or other packages.
The specific details of these extensions of the Operational Period will
be provided to the Subscriber by information posted on the GeoTrustWeb site, the enrollment form, and/or the Subscriber Agreement. The
Operational Period for a Certificate will be stated in the Certificate.
4. Installation of Certificates:
Certificates may not be installed on more than a single
server at a time unless Subscriber has requested to do so during theenrollment process and has paid the corresponding fees for installation
on multiple servers.
2.
5. Technical Requirements of Certificates

1 of 10In order to use a Certificate, the appropriate server software must
support SSL.
ٛ .II. GENERAL PROVISIONS
ٛ .A. Obligations
ٛ .1. GeoTrust Obligations
ٛ .GeoTrust will: (i) issue Certificates in accordance with this CPS; (ii)perform limited authentication of Subscribers as described in this CPS;(iii) revoke Certificates as described in this CPS; and (iv) perform anyother functions which are described within this CPS.
ٛ .2. Subscriber Obligations
ٛ .Subscriber will submit truthful information about itself and its
business entity, domain ownership and contacts, as applicable.
Subscribers will at all times abide by this CPS and a Subscriber will
immediately request revocation of a Certificate if the related Private
Key is Compromised. The Subscriber will only use the GeoTrust True
BusinessID Server Certificate and GeoTrust True BusinessID Wildcard
Certificate for purposes of negotiating SSL sessions. The Subscriber issolely responsible for the protection of its Private Key and for notifying
GeoTrust immediately in the event that its Private Key has beenCompromised.
2.
3. Organization Obligations for Enterprise SSL Service
If the Organization has subscribed to GeoTrust’s Enterprise SSL
service, as part of the enrollment process, the Organization is required
to appoint a Certificate Administrator with authority to approve theissuance and revocation of Certificates for the authenticated domainnames in accordance with this CPS and any Subscriber Agreement.
The Organization may change its designated Certificate Administrator
by providing written notice to GeoTrust. GeoTrust will provide theCertificate Administrator with a unique member ID or URL and with auser name and password (or client certificate) for the purpose ofordering and approving issuance of the Certificates. The Certificate
Administrator may share the unique member ID or URL with others
within the Organization to permit them to submit orders for the
Certificates, but will not share the user name and password (or clientcertificate) necessary for approval of issuance and revocation of theCertificates. All communications concerning the approval of
Certificates to be issued to the Organization will be made by andthrough the designated Certificate Administrator. The Certificate
Administrator will be responsible for verifying all the information in all
Certificate orders submitted to GeoTrust on behalf of Organization,
and GeoTrust shall have no responsibility for verifying the accuracy orlegitimacy of these orders. The Certificate Administrator must notify
GeoTrust immediately in the event he or she becomes aware of a
Certificate that should be revoked for any reason.

4. Relying Party Obligations
Relying Parties must verify that the Certificate is valid by examining
the Certificate Revocation List before initiating a transaction involving
such Certificate. GeoTrust does not accept responsibility for relianceon a fraudulently obtained Certificate or a Certificate that is on the
CRL.
B. Feesٛ .1. Issuance, Management, and Renewal Fees
ٛ .GeoTrust is entitled to charge Subscribers for the issuance,
management, and renewal of Certificates. The fees charged will be as
stated on GeoTrust’s Web site or in any applicable contract at the time
the Certificate is issued or renewed, and may change from time to time
without prior notice.
ٛ .2. Certificate Access Fees
ٛ .GeoTrust does not charge a fee as a condition of making a
Certificate available in a repository or otherwise making Certificatesavailable to Relying Parties.
ٛ .3. Revocation or Status Information Fees
ٛ .GeoTrust does not charge a fee as a condition of making the CRL

Cyber Trading Co. https://yt.com/

required by CPS Section II. I available in a repository or otherwise
available to Relying Parties. GeoTrust may, however, charge a feefor providing customized CRLs, OCSP services, or other value-added
revocation and status information services. GeoTrust does not permit
access to revocation information, Certificate status information, or timestamping in its repository by third parties that provide products orservices that utilize such Certificate status information without
GeoTrust’s prior express written consent.
2.
4. Fees for Other Services Such as Policy Information
3.
5. Refund and Reissue Policy
GeoTrust does not charge a fee for access to this CPS.
GeoTrust’s refund policy is available for review on the GeoTrust website at http://www.geotrust.com/resources. If a Subscriber has paid thefees for the Certificate to another party such as a reseller, theSubscriber should request the refund from that party.
A Subscriber may apply a refund toward the issuance of a substituteCertificate. To obtain a substitute Certificate, the Subscriber must
provide a new Certificate Signing Request to GeoTrust or request
reissue of a Certificate based upon a prior Certificate Signing Request
previously provided to GeoTrust by the Subscriber.
GeoTrust will not revoke a Certificate previously issued following a
refund or reissue request. A request for a refund or reissue of a
Certificate will not be treated as a request by the Subscriber for
revocation of a Certificate previously issued by GeoTrust unless the
Subscriber follows the procedures for requesting revocation as
stated at Section III.I. of this CPS.
C. Compliance Audit
An annual WebTrust for Certification Authorities examination will be
performed for the Certificates issued under this CPS. GeoTrust’s CA
compliance audits are performed by a public accounting firm that (1)demonstrates proficiency in public key infrastructure technology,
information security tools and techniques, security auditing, and thethird-party attestation function, and (2) is accredited by the American
Institute of Certified Public Accountants (AICPA), which requires thepossession of certain skill sets, quality assurance measures such as
peer review, competency testing, standards with respect to proper
assignment of staff to engagements, and requirements for continuing
professional education. Compliance audits of GeoTrust’s operations
will be performed by a public accounting firm that is independent of
GeoTrust. The scope of GeoTrust’s annual WebTrust for Certification
Authorities examination will include certificate life cycle management
and CA business practices disclosure.
With respect to WebTrust audits of GeoTrust’s operations, significant
exceptions or deficiencies identified during the WebTrust audit will
result in a determination of actions to be taken. This determination ismade by GeoTrust management with input from the auditor.
GeoTrust management is responsible for developing andimplementing a corrective action plan. If GeoTrust determines thatsuch exceptions or deficiencies pose an immediate threat to thesecurity or integrity of the Certificates issued under this CPS, acorrective action plan will be developed within 30 days andimplemented within a commercially reasonable period of time. Forless serious exceptions or deficiencies, GeoTrust management will
evaluate the significance of such issues and determine the appropriate
course of action. Results of the WebTrust audit of GeoTrust’s
operations may be released at the discretion of GeoTrust
management.
GeoTrust also performs periodic internal security audits performed by

2 of 10トゥルービジネス規約
trained and qualified security personnel according to GeoTrust’s
security policies and procedures. Results of the periodic audits
are presented to GeoTrust’s PKI Policy Authority with a descriptionof any deficiencies noted and corrective actions taken.
D. Limited Warranty/Disclaimer
GeoTrust provides the following limited warranty at the time of
Certificate issuance: (i) it issued the Certificate substantially incompliance with this CPS; (ii) the information contained within theCertificate accurately reflects the information provided to GeoTrust by
the Applicant in all material respects; and (iii) it has taken reasonable
steps to verify that the information within the Certificate is accurate.
The nature of the steps GeoTrust takes to verify the information
contained in a Certificate is set forth in Section III of this CPS.
EXCEPT FOR THE LIMITED WARRANTY DESCRIBED ABOVE,
GEOTRUST EXPRESSLY DISCLAIMS AND MAKES NO
REPRESENTATION, WARRANTY OR COVENANT OF ANY KIND,
WHETHER EXPRESS OR IMPLIED, EITHER IN FACT OR BY
OPERATION OF LAW, WITH RESPECT TO THIS CPS OR ANY
CERTIFICATE ISSUED HEREUNDER, INCLUDING WITHOUT
LIMITATION, ALL WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE OR USE OF A
CERTIFICATE OR ANY SERVICE (INCLUDING, WITHOUT
LIMITATION, ANY SUPPORT SERVICES) PROVIDED BYGEOTRUST AS DESCRIBED HEREIN, AND ALL WARRANTIES,REPRESENTATIONS, CONDITIONS, UNDERTAKINGS, TERMS
AND OBLIGATIONS IMPLIED BY STATUTE OR COMMON LAW,TRADE USAGE, COURSE OF DEALING OR OTHERWISE ARE
HEREBY EXCLUDED TO THE FULLEST EXTENT PERMITTED BY
LAW. EXCEPT FOR THE LIMITED WARRANTY DESCRIBEDABOVE, GEOTRUST FURTHER DISCLAIMS AND MAKES NO
REPRESENTATION, WARRANTY OR COVENANT OF ANY KIND,
WHETHER EXPRESS OR IMPLIED, EITHER IN FACT OR BY
OPERATION OF LAW, TO ANY APPLICANT, SUBSCRIBER OR ANY
RELYING PARTY THAT (A) THE SUBSCRIBER TO WHICH IT HAS
ISSUED A CERTIFICATE IS IN THE FACT THE PERSON, ENTITY
OR ORGANIZATION IT CLAIMS TO HAVE BEEN (B) A
SUBSCRIBER IS IN FACT THE PERSON, ENTITY OR
ORGANIZATION LISTED IN THE CERTIFICATE, OR (C) THAT THE
INFORMATION CONTAINED IN THE CERTIFICATES OR IN ANY
CERTIFICATE STATUS MECHANISM COMPILED, PUBLISHED OR
OTHERWISE DISSEMINATED BY GEOTRUST, OR THE RESULTS
OF ANY CRYPTOGRAPHIC METHOD IMPLEMENTED IN
CONNECTION WITH THE CERTIFICATES IS ACCURATE,AUTHENTIC, COMPLETE OR RELIABLE.
IT IS AGREED AND ACKNOWLEDGED THAT APPLICANTS ARE
LIABLE FOR ANY MISREPRESENTATIONS MADE TO GEOTRUSTAND RELIED UPON BY A RELYING PARTY. GEOTRUST DOES
NOT WARRANT OR GUARANTEE UNDER ANY CIRCUMSTANCES
THE "NON-REPUDIATION" BY A SUBSCRIBER AND/OR RELYINGPARTY OF ANY TRANSACTION ENTERED INTO BY THE
SUBSCRIBER AND/OR RELYING PARTY INVOLVING THE USE
OF OR RELIANCE UPON A CERTIFICATE.

トゥルービジネス規約
SURROUNDING THE TRANSACTION IN WHICH THE CERTIFICATEIS USED IN DETERMINING SUCH RELIANCE.
THE SUBSCRIBERS AND RELYING PARTIES AGREE AND
ACKNOWLEDGE THAT CERTIFICATES HAVE A LIMITEDOPERATIONAL PERIOD AND MAY BE REVOKED AT ANY TIME.
SUBSCRIBERS AND RELYING PARTIES ARE UNDER AN
OBLIGATION TO VERIFY WHETHER A CERTIFICATE IS EXPIREDOR HAS BEEN REVOKED. GEOTRUST HEREBY DISCLAIMS ANY
AND ALL LIABILITY TO SUBSCRIBERS AND RELYING PARTIESWHO DO NOT FOLLOW SUCH PROCEDURES. MORE
INFORMATION ABOUT THE SITUATIONS IN WHICH A
CERTIFICATE MAY BE REVOKED CAN BE FOUND IN SECTION
III(I) OF THIS CPS.
GeoTrust provides no warranties with respect to another party's
software, hardware or telecommunications or networking equipment
utilized in connection with the use, issuance, revocation or
management of Certificates or providing other services (including,
without limitation, any support services) with respect to this CPS.
Applicants, Subscribers and Relying Parties agree and acknowledge
that GeoTrust is not responsible or liable for any misrepresentations orincomplete representations of Certificates or any information contained
therein caused by another party's application software or graphicaluser interfaces. The cryptographic key-generation technology used by
Applicants, Subscribers and Relying Parties in conjunction with theCertificates may or may not be subject to the intellectual property
rights of third parties. It is the responsibility of Applicants, Subscribers
and Relying Parties to ensure that they are using technology that isproperly licensed or to otherwise obtain the right to use suchtechnology
E. Limitation on Liability
EXCEPT TO THE EXTENT CAUSED BY GEOTRUST'S WILLFULMISCONDUCT, IN NO EVENT SHALL THE CUMULATIVE
LIABILITY OF GEOTRUST TO APPLICANTS, SUBSCRIBER
AND/OR ANY RELYING PARTY FOR ALL CLAIMS RELATED TO
THE INSTALLATION OF, USE OF OR RELIANCE UPON A
CERTIFICATE OR FOR THE SERVICES PROVIDED HEREUNDERINCLUDING WITHOUT LIMITATION ANY CAUSE OF ACTIONSOUNDING IN CONTRACT, TORT (INCLUDING NEGLIGENCE),
STRICT LIABILITY, FOR BREACH OF A STATUTORY DUTY OR IN
ANY OTHER WAY EXCEED TEN THOUSAND U.S. DOLLARS($10,000.00).
GEOTRUST SHALL NOT BE LIABLE IN CONTRACT, TORT(INCLUDING NEGLIGENCE), STRICT LIABILITY, FOR BREACH
OF A STATUTORY DUTY OR IN ANY OTHER WAY (EVEN IF
GEOTRUST HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES) FOR:ٛ .(I) ANY ECONOMIC LOSS (INCLUDING, WITHOUT LIMITATION,
LOSS OF REVENUES, PROFITS, CONTRACTS, BUSINESS OR
ANTICIPATED SAVINGS);ٛ .(II) TO THE EXTENT ALLOWED BY APPLICABLE LAW, ANY
LOSS OR DAMAGE RESULTING FROM DEATH OR INJURY OF
SUBSCRIBER AND/OR ANY RELYING PARTY OR ANYONE ELSE;(III) ANY LOSS OF GOODWILL OR REPUTATION; OR

IT IS UNDERSTOOD AND AGREED UPON BY SUBSCRIBERS ANDRELYING PARTIES THAT IN USING AND/OR RELYING UPON A
CERTIFICATE THEY ARE SOLELY RESPONSIBLE FOR THEIRRELIANCE UPON THAT CERTIFICATE AND THAT SUCH PARTIESMUST CONSIDER THE FACTS, CIRCUMSTANCES AND CONTEXT

Cyber Trading Co. https://yt.com/(IV) ANY OTHER INDIRECT, CONSEQUENTIAL,
INCIDENTAL, MULTIPLE, SPECIAL, PUNITIVE,
EXEMPLARY DAMAGES

3 of 10IN ANY CASE WHETHER OR NOT SUCH LOSSES OR DAMAGESWERE WITHIN THE CONTEMPLATION OF THE PARTIES AT THE
TIME OF THE APPLICATION FOR, INSTALLATION OF, USE OF
OR RELIANCE ON THE CERTIFICATE, OR AROSE OUT OF ANYOTHER MATTER OR SERVICES (INCLUDING, WITHOUT
LIMITATION, ANY SUPPORT SERVICES) UNDER THIS CPS OR
WITH REGARD TO THE USE OF OR RELIANCE ON THE
CERTIFICATE.
BECAUSE SOME JURISDICTIONS DO NOT ALLOW THE
EXCLUSION OR LIMITATION OF INCIDENTAL OR
CONSEQUENTIAL DAMAGES, THE ABOVE EXCLUSIONS OF
INCIDENTAL AND CONSEQUENTIAL DAMAGES MAY NOT APPLYTO AN APPLICANT, SUBSCRIBER AND/OR A RELYING PARTY
BUT SHALL BE GIVEN EFFECT TO THE FULL EXTENTPERMITTED BY LAW.
THE FOREGOING LIMITATIONS OF LIABILITY SHALL APPLY ON A
CERTIFICATE-BY-CERTIFICATE BASIS, REGARDLESS OF THE
NUMBER OF TRANSACTIONS OR CLAIMS RELATED TO EACH
CERTIFICATE, AND SHALL BE APPORTIONED FIRST TO THE
EARLIER CLAIMS TO ACHIEVE FINAL RESOLUTION.
In no event will GeoTrust be liable for any damages to Applicants,
Subscribers, Relying Parties or any other party arising out of or related
to the use or misuse of, or reliance on any Certificate issued under thisCPS that: (i) has expired or been revoked; (ii) has been used for any
purpose other than as set forth in the CPS (See Section I(c) for moredetail); (iii) has been tampered with;(iv) with respect to which the Key Pair underlying such Certificate or
the cryptography algorithm used to generate such Certificate's Key
Pair, has been Compromised by the action of any party other than
GeoTrust (including without limitation the Subscriber or Relying
Party); or (v) is the subject of misrepresentations or other misleading
acts or omissions of any other party, including but not limited to
Applicants, Subscribers and Relying Parties.
In no event shall GeoTrust be liable to the Applicant, Subscriber,
Relying Party or other party for damages arising out of any claim thata Certificate infringes any patent, trademark, copyright, trade secretor other intellectual property right of any party.
F. Force Majeure
GeoTrust shall not be liable for any default or delay in theperformance of its obligations hereunder to the extent and while
such default or delay is caused, directly or indirectly, by fire, flood,earthquake, elements of nature or acts of God, acts of war, terrorism,
riots, civil disorders, rebellions or revolutions in the United States,
strikes, lockouts, or labor difficulties or any other similar cause
beyond the reasonable control of GeoTrust.
G. Financial Responsibility
1. Fiduciary Relationships
GeoTrust is not an agent, fiduciary, trustee, or otherrepresentative of the Applicant or Subscriber and the relationshipbetween GeoTrust and the Applicant and the Subscriber is not that ofan agent and a principal. GeoTrust makes no representation to thecontrary, either explicitly, implicitly, by appearance or otherwise.
Neither the Applicant nor the Subscriber has any authority to bind
GeoTrust by contract or otherwise, to any obligation.
2.
2. Indemnification by Applicant and Subscriber
Unless otherwise set forth in this CPS and/or Subscriber Agreement,
Applicant and Subscriber, as applicable, hereby agrees to indemnify

Cyber Trading Co. https://yt.com/

and hold GeoTrust (including, but not limited to, its officers, directors,
employees, agents, successors and assigns) harmless from any
claims, actions, or demands that are caused by the use or publicationof a Certificate and that arises fromٛ .(a) any false or misleading statement of fact by the Applicant (or any
person acting on the behalf of the Applicant) (b) any failure by the
Applicant or the Subscriber to disclose a material fact, if such omission
was made negligibly or with the intent to deceive; (c) any failure on thepart of the Subscriber to protect its Private Key and Certificate or totake the precautions necessary to prevent the Compromise, disclosure,loss, modification or unauthorized use of the Private Key or Certificate;or (d) any failure on the part of the Subscriber to promptly notify
GeoTrust, as the case may be, of the Compromise, disclosure, loss,
modification or unauthorized use of the Private Key or Certificate once
the Subscriber has constructive or actual notice of such event.
ٛ .H. Interpretation & Enforcement
1. Governing Law
The enforceability, construction, interpretation, and validity of thisCPS and any Certificates issued by GeoTrust shall be governed by
the substantive laws of the Commonwealth of Massachusetts, UnitedStates of America, excluding (i) the conflicts of law provisions thereofand(ii) the United Nations Convention on Contracts for the International
Sale of Goods.
2. Dispute Resolution Procedures
Any dispute, controversy or claim arising under, inconnection with or relating to this CPS or any Certificate issued by
GeoTrust shall be subject to and settled finally by binding arbitration inaccordance with the Arbitration Rules of the American Arbitration
Association (AAA). All arbitration proceedings shall be held in Boston,
Massachusetts. There shall be one arbitrator appointed by the AAA
who shall exhibit a reasonable familiarity with the issues involved orpresented in such dispute, controversy or claim. The award of thearbitrator shall be binding and final upon all parties, and judgment on
the award may be entered by any court having proper jurisdiction
thereof. This CPS and the rights and obligations of the parties
hereunder and under any Certificate issued by GeoTrust shall remain
in full force and effect pending the outcome and award in any
arbitration proceeding hereunder. In any arbitration arising hereunder,
each party to the preceding shall be responsible for its own costs
incurred in connection with the arbitration proceedings, unless thearbitrator determines that the prevailing party is entitled to an award of
all or a portion of such costs, including reasonable attorneys fees
actually incurred.
2.
3. Conflict of Provisions
This CPS represents the entire agreement between any Subscriber(including the Subscriber Agreement, if any) or Relying Party and
GeoTrust and supersedes any and all prior understandings andrepresentations pertaining to its subject matter. In the event,
however, of a conflict between this CPS and any other express
agreement a Subscriber has with GeoTrust with respect to a
Certificate, including but not limited to a Subscriber Agreement,such other agreement shall take precedence.
4. Severability
If any provision of this CPS shall be held to be invalid, illegal, or
unenforceable, the validity, legality, or enforceability of the remainderof this CPS shall not in any way be affected or impaired hereby.
I. Repository and CRL
With regard to GeoTrust True BusinessID Server Certificates and
GeoTrust True BusinessID Wildcard Certificates (including those
provided through the Enterprise SSL service), GeoTrust shall
operate a CRL that will be available to both Subscribers and

4 of 10トゥルービジネス規約

トゥルービジネス規約

GeoTrust retains copies of all Certificates for the life of the CA, butdoes not archive or retain expired or superceded CRLs. GeoTrustdoes not provide other online status mechanisms (e.g., OCSP) forchecking certificate status requests.

approval and acceptance by GeoTrust. All Applicants are required toinclude a Domain Name within the enrollment form and an
Organizational Name that will also appear on the Certificate. A
Certificate may contain additional information as well. GeoTrust does
not verify the authority of the Subscriber to request a Certificate.
GeoTrust performs the authentication steps listed below (and checks
generally for errors and omissions relevant to the authentication steps
taken), but does not otherwise verify the accuracy of the information
contained in the Subscriber’s Certificate request or otherwise check forerrors and omissions.

For True BusinessID and Wildcard Certificates, GeoTrust willprocess the Certificate enrollment forms to confirm the informationon the Certificates as discussed above. However, GeoTrust reserves
the right to waive such procedures and issue a Certificate utilizing
different authentication procedures in certain circumstances;provided that (a) the general principles for verifying the application
information is maintained, and (b) and such issuance is approved bya GeoTrust Director Level or above. In addition, GeoTrust may use
subcontractors or other third parties to assist in the performance of
its operational requirements or any other obligation under this CPS.

J. Confidentiality Policy

B. Certificate Information

1. Individual Subscriber Information
Except as provided herein, certain information regarding
Subscribers that is submitted on enrollment forms for Certificates will
be kept confidential by GeoTrust (such as contact information for
individuals and credit card information) and GeoTrust shall not releasesuch information without the prior consent of the Subscriber.
Notwithstanding the foregoing, GeoTrust may make such information
available (a) to courts, law enforcement agencies or other third parties(including release in response to civil discovery) upon receipt of acourt order or subpoena or upon the advice of GeoTrust's legal
counsel, (b) to law enforcement officials and others for the purpose ofinvestigating suspected fraud, misrepresentation, unauthorized access,or potential illegal activity by the Subscriber in the opinion of GeoTrustand (c) to third parties as may be necessary for GeoTrust to perform
its responsibilities under this Agreement. The foregoing confidentiality
obligation shall not apply, however, to information appearing on
Certificates, information relating to Certificate revocation, or to
information regarding Subscribers that is already in the possession ofor separately acquired by GeoTrust.
2.
2. Aggregate Subscriber Information

1. Domain Name.
GeoTrust will verify that the Subscriber had the right to use
the Domain Name submitted by the Subscriber at the time it submitted
its application. For instance, GeoTrust may perform this verification byconfirming that the Subscriber is the same person or entity that holds
the Domain Name registration from the relevant domain name registrar
or that the Subscriber is otherwise authorized to use such Domain
Name. Domain names do not have to be meaningful or unique, butmust match a second level domain name as posted by InterNIC.
GeoTrust is not involved in the recognition, authentication, or role oftrademarks involved in domain names. Name disputes (including
trademark disputes) are not resolved by GeoTrust, but are to beresolved between the Subscriber and other disputing parties byInterNIC at time of application according to applicable InterNIC rules
and/or by courts of competent jurisdiction.
2.
2. Organizational NameFor Certificates issued through the Enterprise SSL service, theCompany’s Certificate Administrator provides GeoTrust with anapproved list of domain names for vetting. Individuals within the
Company’s organization may apply for Certificates directly by using
the Company’s unique member ID or URL provided by GeoTrust.
GeoTrust checks the applicant’s domain name against the Company’s
pre-vetted domain name list and forwards Certificate requests thatcoincide with the Company’s pre-approved domain names to
GeoCenter, where the Company’s Certificate Administrator approves
or rejects the Certificate request. If the request is approved,
GeoTrust proceeds with issuing a Certificate to the individual who
submitted the request. If denied, the order is cancelled and Company
is not charged for the Certificate. Enterprise Administrators
requesting Certificates via the Enterprise SSL service will be required
to agree to terms and conditions of use as necessary for issuance of a
Certificate to an individual, and individuals receiving Certificates via
the Enterprise SSL service may be required to agree to additionalterms and conditions of use as necessary to receive a Certificate
authorized by the Administrator.

Relying Parties. GeoTrust shall post the CRL online at least
weekly in a DER format except as otherwise provided in GeoTrust’s
Business Continuity Plan. Each CRL is signed by the issuing
GeoTrust CA. The procedures for revocation are as statedelsewhere in this CPS.

Notwithstanding the previous Section, GeoTrust may disclose
Subscriber information on an aggregate basis, and the Subscriber
hereby grants to GeoTrust a license to do so, including the right tomodify the aggregated Subscriber information and to permit third
parties to perform such functions on its behalf. GeoTrust shall notdisclose to any third party any personally identifiable information about
any Subscriber that GeoTrust obtains in its performance of services
hereunder.
K. WaiverA failure or delay in exercising any right or remedy hereunder shall not
operate as a waiver of that right or remedy, nor shall any single orpartial exercise of any right or remedy preclude any other or further
exercise thereof or the exercise of any other right or remedy.
L. Survival
The following sections shall survive, along with all definitions required
thereby: Sections I, II, andٛ .VIII.
ٛ .M. Export
Subscribers and Relying Parties acknowledge and agree to use
Certificates in compliance with all applicable laws and regulations,
including without limitation U.S. export laws and regulations. GeoTrust
may refuse to issue or may revoke Certificates if in the reasonable
opinion of GeoTrust such issuance or the continued use of such
Certificates would violate applicable laws and regulations.
ٛ .III. OPERATIONAL REQUIREMENTS
ٛ .A. Application Requirements
An Applicant for a GeoTrust True BusinessID Server or Wildcard
Certificate shall complete a GeoTrust enrollment form in a form
prescribed by GeoTrust. All enrollment forms are subject to review,

Cyber Trading Co. https://yt.com/

GeoTrust will take reasonable steps to establish that a Certificate
request made on behalf of that Organization is legitimate and properly
authorized. GeoTrust will ensure the following: (a) the Organizational
Name appears in conjunction with a country and possibly a state orprovince of other locality to sufficiently identify its place of registration
or a place where it is currently doing business; and (b) in the case ofan Organization that could reasonably be expected to be registeredwith a local, state or national authority, in certain circumstances
GeoTrust will obtain, view and verify copies of the registration
documents. For instance, GeoTrust may (w) verify the validity of theregistration through the authority that issued it, or (x) verify the validityof the registration through a reputable third party database or otherresource, or (y) verify the validity of the Organization through a trusted
third party, or (z) confirm that the Organization exists if such
Organization is not the type that is typically registered or is capable ofbeing verified under clause (y).
In addition, to prove that a Certificate is duly authorized by theOrganization, GeoTrust will typically request the name of a contact
person who is employed by or is an officer of the Organization.
GeoTrust will also typically require a form of authorization from theOrganization confirming its intent to obtain a Certificate and willusually document the Organization's contact person. GeoTrust
normally confirms the contents of this authorization with the listed
contact person.
C. Procedure for Processing Certificate Applications
Subscribers submit their Public Key to GeoTrust for certificationelectronically through the use of a PKCS#10 Certificate Signing
Request (CSR) or other package digitally signed by the Subscriber’s
Private Key in a session secured by Secure Sockets Layer (SSL). At
a minimum, the Subscriber must provide the following data in or with
the CSR: Common Name, Organization, and Country. The following
additional information is required on the enrollment form: the names,
e-mail addresses, and telephone numbers for the Administrative,
Technical, Support, and Billing points of contact.

5 of 10

D. Application Issues
At certain times during the application process in which GeoTrust is
not able to verify information in an enrollment form, a customer
service representative may be assigned to the applicant to facilitate
the completion of the application process. Otherwise, the applicant
may be required to correct its associated information with third parties
and re-submit its enrollment form for a Certificate.

G. Certificate Renewal and Rekey
Prior to the expiration of an existing Subscriber’s Certificate, it isnecessary for the Subscriber to obtain a new Certificate to maintaincontinuity of Certificate usage. Subscribers have the option ofgenerating a new Key Pair to replace the expiring Key Pair (technicallydefined as “rekey”) or of creating a new Certificate Signing Request foran existing Key Pair (technically defined as “renewal”), depending on
their preferences and the capabilities and restrictions of the
Subscriber’s web server and web server key generation tools. For
purposes of this CPS, both a “rekey” and “renewal” as defined above
will be treated as a renewal Certificate.
Renewal Certificates are subject to the same authentication steps
outlined in this CPS as apply to initial issuance of a Certificate exceptthat Subscriber will not be required to submit registration documents to
GeoTrust if Subscriber’s (a) Organization name has not changed, (b)fully qualified Domain Name has not changed, and (c) Subscriber has
not indicated in the enrollment form that such information has changed
during the time since it was originally submitted. Expiring Certificatesare not revoked by GeoTrust upon issuance of the renewal Certificate.
The Subscriber must pay the fees and comply with the other terms
and conditions for renewal as presented on GeoTrust’s Web site.
GeoTrust may provide discounted prices and extended Operational
Periods (see I.C.3) for renewal Certificates.
H. Certificate Expiration
GeoTrust will attempt to notify all Subscribers of the expiration date of
their Certificate. Notifications will generally be by e-mail message tothe administrative, technical, and/or billing contacts listed in theenrollment form submitted by Subscriber, and will likely occur
periodically during the 90 day period prior to the expiration date andthe 14 day period following the expiration date. If Subscriber’s
enrollment form was submitted by another party on Subscriber’s behalf,
GeoTrust likely will not send expiration notices to that party due tocontractual limitations.
I. Certificate Revocation

E. Certificate Delivery
1. Circumstances For Revocation
If GeoTrust finds that the applicant's enrollment form was sufficiently
verified, then the applicant's Certificate will be signed by GeoTrust.
Upon signing the applicant's Certificate, GeoTrust will attach such
Certificate to an e-mail and send such e-mail to the appropriate
contacts or make the Certificate available via the Application
Programming Interface (API). The e-mail will typically be sent to theadministrative contact, technical contact and billing contact designatedby the Subscriber. Notification will not be sent to others than thesubject of the Certificate and the subject’s designated contacts. In
certain circumstances the e-mail may include a GeoTrust customer
service representative telephone number and e-mail address for any
technical or customer service problems. GeoTrust, in its sole discretion,
may provide such technical or customer support to theapplicants/Subscribers. GeoTrust does not distribute Certificates via
Integrated Circuit Cards (ICC) to Subscribers.

Certificate revocation is the process by which GeoTrust prematurely
ends the Operational Period of a Certificate by posting the serial
number of the Certificate to a Certificate Revocation List.
A Subscriber shall inform GeoTrust and promptly request revocation ofa Certificate:.
•
whenever any of the information on the Certificate
changes or becomes obsolete; or.
•
whenever the Private Key, or the media holding
the Private Key, associated with the Certificate is Compromised; or.
•upon a change in the ownership of a Subscriber's
web server.
Subscriber shall state the reason(s) for requesting revocation upon
submitting the request.
GeoTrust shall revoke a Certificate:

F. Certificate Acceptance
The applicant expressly indicates acceptance of a Certificate by using
such Certificate.

Cyber Trading Co. https://yt.com/.
•
upon request of a Subscriber as described above;.
•in the event of Compromise of GeoTrust's Private
Key used to sign a Certificate;.
•upon the Subscriber's breach of either this CPS or

6 of 10トゥルービジネス規約

トゥルービジネス規約

Subscriber Agreement;.
•
if GeoTrust determines that the Certificate was notproperly issued; or.
•in the event the Certificate is installed on morethan a single server at a time without permission of GeoTrust.

L. Subscriber Key Pair Generation

If GeoTrust initiates revocation of a Certificate, GeoTrust shall notify
the administrative and technical contact provided by Subscriber by
e-mail message of the revocation and the reasons why. In the eventthat GeoTrust ceases operations, all Certificates issued by GeoTrustshall be revoked prior to the date that GeoTrust ceases operations,and GeoTrust shall notify the administrative and technical contact
provided by Subscriber by e-mail message of the revocation and thereasons why.

M. Records Archival

A refund and/or reissue request by a Subscriber pursuant to Section
II.B.5 will not be treated as a request for revocation of a Certificate
under this subsection unless the Subscriber specifically requests
revocation of the Certificate.
2. Who Can Request Revocation
The only persons permitted to request revocation of a
Certificate issued by GeoTrust are the Subscriber (including
designated representatives), the administrative or technical contact,
Certificate Administrator (for Enterprise SSL). For the Enterprise SSL
service, the Subscriber’s Certificate Administrator may request
revocation of a Certificate.
2.
3. Procedure For Revocation Request
To request revocation, a Subscriber must contact GeoTrust, either by
e-mail message, a national/regional postal service, facsimile, orovernight courier, and specifically request “revocation” (using thatterm) of a particular Certificate identified by the Subscriber. Upon
receipt of a revocation request, GeoTrust will seek confirmation of therequest by e-mail message to the person requesting revocation (asdefined in SectionIII.I.2 above). The message will state that, upon
confirmation of the revocation request, GeoTrust will revoke theCertificate and that posting the revocation to the appropriate CRL will
constitute notice to the Subscriber that the Certificate has been
revoked. GeoTrust will require a confirming e-mail message backfrom either the administrative or technical contact authorizing
revocation (or by other means of confirmation acceptable to GeoTrust).
Upon receipt of the confirming e-mail message, GeoTrust will revoke
the Certificate and the revocation will be posted to the appropriate
CRL. Notification will be sent to the subject of the Certificate and thesubject’s designated contacts. There is no grace period available to
the Subscriber prior to revocation, and GeoTrust shall respond to therevocation request within the next business day and post therevocation to the next published CRL.
In the event of Compromise of GeoTrust's Private Key used to sign a
Certificate; GeoTrust will send an e-mail message as soon aspracticable to all Subscribers with Certificates issued off the Private
Key stating that the Certificates will be revoked by the next business
day and that posting the revocation to the appropriate CRL will
constitute notice to the Subscriber that the Certificate has been
revoked.
J. Certificate Suspension
GeoTrust does not support Certificate suspension for the Certificates.
K. Key Management
GeoTrust does not provide Subscriber Private Key
protection or other Subscriber key management
services in connection with its Certificates.

Cyber Trading Co. https://yt.com/

GeoTrust does not provide Subscriber Key Pair generation or
Subscriber Private Key protection for the Certificates.

Access to the GeoTrust CA facility requires the three authentication
factors of “be and have” incorporating biometrics, keys, andproximity cards. Access to the facility requires a minimum of two
authorized GeoTrust employees and is checked at three
independent physical locations.
C. Power and Air Conditioning

GeoTrust shall maintain and archive records relating to the issuance of
the Certificates for threeٛ .(3) years following the issuance of the applicable Certificate.
ٛ .N. CA Termination
In the event that it is necessary for GeoTrust or its CAs to cease
operation, GeoTrust makes a commercially reasonable effort to
notify Subscribers, Relying Parties, and other affected entities ofsuch termination in advance of the CA termination. Where CA
termination is required, GeoTrust will develop a termination plan tominimize disruption to Subscribers and Relying Parties. Suchtermination plans may address the following, as applicable:.
•
Provision of notice to parties affected by thetermination, such as Subscribers and Relying Parties, informing themof the status of the CA,.
•
Handling the cost of such notice,.
•
The revocation of the Certificate issued to the CA
by GeoTrust,.
•
The preservation of the CA’s archives and records
for the time periods required in this CPS,.
•
The continuation of Subscriber and customer
support services,.
•
The continuation of revocation services, such as
the issuance of CRLs,.
•
The revocation of unexpired unrevoked
Certificates of Subscribers and subordinate CAs, if necessary,.
•
The payment of compensation (if necessary) to
Subscribers whose unexpired unrevoked Certificates are revokedunder the termination plan or provision, or alternatively, the issuanceof replacement Certificates by a successor CA,.
•
Disposition of the CA’s Private Key and the
hardware tokens containing such Private Key,.
•
Provisions needed for the transition of the CA’s
services to a successor CA, and.
•
The identity of the custodian of GeoTrust’s CA
and RA archival records. Unless a different custodian is indicatedthrough notice to Subscribers and Relying Parties, the Registered
Agent for GeoTrust, Inc., a Delaware corporation, shall be thecustodian.
ٛ .IV. PHYSICAL SECURITY CONTROLSٛ .A. Site Location and Construction

GeoTrust’s CA operations are conducted within GeoTrust’s facilities
in Billerica, Massachusetts and Suwanee, Georgia that meet
WebTrust for CAs audit requirements. All GeoTrust CA operations
are conducted within a physically protected environment designed todeter, prevent, and detect covert or overt penetration.
GeoTrust’s CAs are physically located in a highly secure facility that
includes the following:.
•Slab to slab barriers.
•Electronic control access systems.
•
Alarmed doors and video monitoring.
•
Security logging and audits.
•
Proximity card access for specially approved
employees with defined levels ofmanagement approval required

B. Physical Access Controls

7 of 10

dated and signed by all individuals involved. These records are
kept for audit and tracking purposes for a length of time deemed
appropriate by GeoTrust management.
Certificates are issued off the Equifax Secure Certificate
Authority CA, the Equifax Secure eBusiness CA-1, or the
Equifax Secure Global eBusiness CA-1 (the “CA
Certificates”).

GeoTrust’s CA facility is equipped with primary and backup:.
•
Power systems to ensure continuous,
uninterrupted access to electric power and.
•Heating/ventilation/air conditioning systems tocontrol temperature and relative humidity.

The cryptographic modules used for key generation and storage
meet the requirements of FIPS 140-2 level 3. The CA Root Keys foreach CA Certificate were generated and are stored in hardware andare backed up but not escrowed.
The Root Keys for each CA
Certificate are maintained under m out of n multiperson control.

D. Water Exposures
The GeoTrust CA facility is located several stories above ground andis not susceptible to flooding or other forms of water damage.
GeoTrust has take reasonable precautions to minimize the impact ofwater exposure to GeoTrust systems.
E. Fire Prevention and Protection
The fire detection system in GeoTrust CA facility tests air health andlooks for certain signatures of possible fire conditions in the air. In
addition, the GeoTrust CA facility has a pre-action water suppression
system. When temperatures above 300 degrees are detected, theeffected sprinkler head will release water on the area where thetemperature rise is detected.

The Root Keys for each CA Certificate may be used for Certificate
signing (secure e-mail and server authentication), CRL signing, andoff-line CRL signing.
GeoTrust makes the CA Certificates available to Subscribers andRelying Parties through their inclusion in Microsoft and Netscape webbrowser software. For specific applications, GeoTrust’s Public Keys
are provided by the application vendors through the applications root
stores.
GeoTrust generally provides the full certificate chain (including theissuing CA Certificate and any CA Certificates in the chain) to the
Subscriber upon Certificate issuance. GeoTrust CA Certificates may
also be downloaded from the GeoTrust Resource Web site at
http://www.geotrust.com/resources.

F. Media Storage
All media containing production software and data, audit, archive, or
backup information is stored within multiple GeoTrust facilities in TL-30
rated safes with appropriate physical and logical access controls
designed to limit access to authorized personnel and protect suchmedia from accidental damage.
G. Waste Disposal
Sensitive documents and materials are shredded before disposal.
Media used to collect or transmit sensitive information are renderedunreadable before disposal. Cryptographic devices are physicallydestroyed or zeroized in accordance the manufacturers’ guidance prior
to disposal. Other waste is disposed of in accordance with
GeoTrust’s normal waste disposal requirements.
H. Off-Site Backup
GeoTrust performs routine backups of critical system data, audit log
data, and other sensitive information. Critical CA facility backup
media are stored in a physically secure manner at an off-site facility.
V. TECHNICAL SECURITY CONTROLS
A. CA Key Pair
CA Key Pair generation is performed by multiple trained and trusted
individuals using secure systems and processes that provide for the
security and required cryptographic strength for the keys that are
generated. All CA Key Pairs are generated in pre-planned key
generation ceremonies in accordance with the requirements of
GeoTrust security and audit requirements guidelines. The
activities performed in each key generation ceremony are recorded,

Cyber Trading Co. https://yt.com/

There are no restrictions on the purposes for which the CA Key Pair
may be used. The usage period or active lifetime for the Equifax
Secure Certificate Authority CA Public and Private Keys is throughAugust 22, 2018, and are generally available in the Root Key Store of
the applicable browser or application software. The usage period or
active lifetime for the Equifax Secure Certificate eBusiness CA-1 andEquifax Secure Certificate Global eBusiness CA-1 Public and Private
Keys is through June 21, 2020, and are generally available in the Root
Key Store of the applicable browser or application software.
GeoTrust CA Key Pairs are maintained in a trusted and highly
secured environment with backup and key recovery procedures. In
the event of the Compromise of one or more of the GeoTrust Root
Key(s) (including the CA Certificates), GeoTrust shall promptly notify
all Subscribers via e-mail and notify Relying Parties and others via
the CRL and additional notice posted at www.geotrust.com, andshall revoke all Certificates issued with such GeoTrust Root Key(s).
When GeoTrust CA Key Pairs reach the end of their validity period,
such CA Key Pairs will be archived for a period of at least 5 years.
Archived CA Key Pairs will be securely stored using offline media.
Procedural controls will prevent archived CA Key Pairs from being
returned to production use. Upon the end of the archive period,archived CA Private Keys will be securely destroyed.
GeoTrust CA Key Pairs are retired from service at the end of theirrespective maximum lifetimes as defined above, and so there is no keychangeover. Certificates may be renewed as long as the cumulativecertified lifetime of the Certificate Key Pair does not exceed the
maximum CA Key Pair lifetime. New CA Key Pairs will be generated
as necessary, for example to replace CA Key Pairs that are being
retired, to supplement existing, active Key Pairs and to support new

8 of 10トゥルービジネス規約
services in accordance with this CPS.
B. Subscriber Key Pairs
GeoTrust recommends that Subscribers select the highest encryption
strength option (e.g., 1024bit) when generating their certificate
requests. All GeoTrust certificates will accommodate the use ofdomestic and international 128-, 56-, and 40-bit strength browsers andweb servers.
Generation of Subscriber Key Pairs is generally performed by the
Subscriber, and may be generated in either hardware or software.
For server Certificates, the Subscriber typically uses the key
generation utility provided with the web server software. GeoTrustdoes not require any particular standard for the module used togenerate the keys. Key pairs generated by the Subscriber for
Certificates may be used for server authentication. There are no
purposes for which GeoTrust restricts the use of the Subscriber
key.

トゥルービジネス規約
described elsewhere in this CPS. Name constraint enforcement is
not through the name constraint extension, but through theauthentication steps followed and contractual limitations with each
Subscriber. GeoTrust does not apply any specific Certificate Policy
Object Identifier(s), but instead refers to the applicable CPS version
and URL address. The policy constraints extensions and policy
qualifiers syntax and semantics, when used, conform to the RFC 2459
standards.
B. CRL Profile
GeoTrust issued CRLs conform to all RFC 2459 standards andrecommendations.
ٛ .VII. CPS ADMINISTRATIONٛ .A. CPS Authority
The authority administering this CPS is the GeoTrust PKI
Policy Authority. Inquiries to
GeoTrust’s PKI Policy Authority should be addressed asfollows:domain names on behalf of the Organization as part of GeoTrust’s
Enterprise SSL™ service.

Copyright 2004, GeoTrust, Inc.
[v. 2.3 11-17-04]

Certificate Revocation List. A time-stamped list of revoked
Certificates that has been digitally signed by the CA.
Certification Authority. An entity that issues Certificates andperforms all of the functions associated with issuing such
Certificates.
Compromise. Suspected or actual unauthorized disclosure, loss, lossof control over, or use of a Private Key associated with Certificate.
CRL. See Certificate Revocation List.
Extension. means to place additional information about a
Certificate within a Certificate. The X.509 standard defines a setof Extensions that may be used in Certificates.
GeoTrust. GeoTrust, Inc.

For X.509 Version 3 Certificates, GeoTrust generally populates the
KeyUsage extension of Certificates in accordance with RFC 2459:
Internet X.509 Public Key Infrastructure Certificate and CRL Profile,
January 1999.
C. Business Continuity Management Controls
GeoTrust has business continuity plans (BCP) to maintain or restore
the GeoTrust CAs business operations in a reasonably timely
manner following interruption to or failure of critical businessprocesses. The BCP define the following time periods for
acceptable system outage and recovery time:
1.
2.
3.
4.

1. Vet a Subscriber - 1 week
2. Issue a Certificate - 2 weeks
3. Publish a CRL - 2 weeks
4. Audit Vetting Procedures - 2 months

Backup copies of essential business and CA information
are made routinely. In general, back-ups are performed
daily on-site, weekly to an off-site location, and monthly to
GeoTrust’s disaster recovery site, but may be performed
less frequently in GeoTrust’s discretion according to
production schedule requirements. The recovery facilities
are approximately 800 miles from the GeoTrust CA
facility’s main site.
D. Event Logging
GeoTrust CA event journal data is archived both daily and monthly.
Daily event journals are reviewed several times each week.
Monthly event journals are reviewed monthly.
ٛ .VI. CERTIFICATE AND CRL PROFILEٛ .A. Certificate Profile

GeoTrust Certificates conform to (a) ITU-T Recommendation X.509
Version 3 (1997): Information Technology - Open Systems
Interconnection - The Directory: Authentication Framework, June 1997,
and (b) RFC 2459: Internet X.509 Public Key Infrastructure Certificate
and CRL Profile, January 1999 (“RFC 2459”). Certificate extensions
and their criticality, as well as cryptographic algorithm object identifiers,
are populated according to the IETF RFC 2459 standards andrecommendations. The name forms for Subscribers are enforced
through GeoTrust’s internal policies and the authentication steps

Cyber Trading Co. https://yt.com/

GeoTrust, Inc.
117 Kendrick Street, Suite 350
Needham, MA 02494 USA+1 (781) 292-4100 (voice)+1 (781) 444-3961 (fax)pkipolicy@geotrust.com

Key Pair. Two mathematically related keys, having the following
properties: (i) one key can be used to encrypt a message that can
only be decrypted using the other key, and (ii) even knowing one key,
it is computationally impractical to discover the other key.

GeoTrust does not support a Certificate Policy (CP) for True
BusinessID Server and Wildcard Certificates (including those
provided through the Enterprise SSL service).

Operational Period. A Certificate's period of validity. It would
typically begin on the date the Certificate is issued (or such later dateas specified in the Certificate), and ends on the date and time it
expires as noted in the Certificate or is earlier revoked unless it issuspended.

B. Contact Person
Address inquiries about the CPS to pkipolicy@geotrust.com or to thefollowing address:
PKI Policy Administrator GeoTrust, Inc. 117 Kendrick Street, Suite 350
Needham, MA 02494 USA +1 (781) 292-4100 (voice) +1 (781)444-3961 (fax)
C. CPS Change ProceduresThis CPS (and all amendments to this CPS) is subject to approval by
the PKI Policy Authority. GeoTrust may change this CPS at any
time without prior notice. The CPS and any amendments thereto areavailable through http://www.geotrust.com/resources. Amendments tothis CPS will be evidenced by a new version number and date, except
where the amendments are purely clerical.
VIII. DEFINITIONS
CA. Certification Authority.
Certificate. A record that, at a minimum: (a) identifies the CA issuingit; (b) names or otherwise identifies its Subscriber; (c) contains a
Public Key that corresponds to a Private Key under the control of the
Subscriber; (d) identifies its Operational Period; and (e) contains a
Certificate serial number and is digitally signed by the CA. The term
Certificate, as referred to in this CPS, means a Certificate issued by
GeoTrust pursuant to this CPS.
Certificate Administrator. An individual designated by theOrganization to approve the issuance of Certificates for the vetted

9 of 10

Organization. The entity named or identified in a Certificate in the
Organizational Name field that has either subscribed to GeoTrust’s
Enterprise SSL Service or purchased a Certificate.
Private Key. The key of a Key Pair used to create a digital signature.
This key must be kept a secret.
Public Key. The key of a Key Pair used to verify a digital signature.
The Public Key is made freely available to anyone who will receive
digitally signed messages from the holder of the Key Pair. The
Public Key is usually provided via a Certificate issued by GeoTrust.
A Public Key is used to verify the digital signature of a message
purportedly sent by the holder of the corresponding Private Key.
Relying Party. A recipient of a digitally signed message who relies
on a Certificate to verify the digital signature on the message. Also,a recipient of a Certificate who relies on the information contained in
the Certificate.
Root Key(s). The Private Key used by GeoTrust to sign theCertificates.
SSL. An industry standard protocol that uses public key cryptography
for Internet security.
Subscriber. A person or entity who (1) is the subject named or
identified in a Certificate issued to such person or entity, (2) holds a
Private Key that corresponds to a Public Key listed in that Certificate,and (3) the person or entity to whom digitally signed messages verified
by reference to such Certificate are to be attributed. For the purpose ofthis CPS, a person or entity who applies for a Certificate by thesubmission of an enrollment form is also referred to as a Subscriber.

Cyber Trading Co. https://yt.com/

10 of 10