Version.1.01
341-25-A001-01

Secom Passport Plus
Certificate Policy
Version 1.01

May 17, 2023
SECOM Trust Systems Co., Ltd.

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.

Version.1.01
341-25-A001-01
Version History
VersionNumber1.00

Date2022/04/08

Description
Publication of the first version“7.1 Certificate Profile” Modified the Table Number

1.01

2023/05/17“9.6.3 Applicant and Subscriber Representations andWarranties” Modified descriptions

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
I

Version.1.01
341-25-A001-01

Table of Contents
1. Introduction ....................................................................................................................... 1
1.1 Overview ...................................................................................................................... 1
1.2 Document Name and Identification ........................................................................... 2
1.3 PKI Participants.......................................................................................................... 2
1.3.1 CA .......................................................................................................................... 2
1.3.2 RA .......................................................................................................................... 2
1.3.3 Applicants and Subscribers ................................................................................. 3
1.3.4 Relying Parties ..................................................................................................... 3
1.3.5 Other Parties ........................................................................................................ 3
1.4 Certificate Usage ......................................................................................................... 3
1.4.1 Appropriate Certificate Uses ............................................................................... 3
1.4.2 Prohibited Certificate Uses .................................................................................. 3
1.5 Policy Administration ................................................................................................. 3
1.5.1 Organization Administering the Document ....................................................... 3
1.5.2 Contact Information ............................................................................................. 3
1.5.3 Person Determining CP Suitability for the Policy ............................................. 4
1.5.4 Approval Procedure .............................................................................................. 4
1.6 Definitions and Acronyms........................................................................................... 4
2. Publication and Repository Responsibilities................................................................... 8
2.1 Repository .................................................................................................................... 8
2.2 Publication of Certificate Information ....................................................................... 8
2.3 Time or Frequency of Publication .............................................................................. 8
2.4 Access Controls on Repository .................................................................................... 8
3. Identification and Authentication.................................................................................... 9
3.1 Naming......................................................................................................................... 9
3.1.1 Types of Names ..................................................................................................... 9
3.1.2 Need for Names to Be Meaningful ...................................................................... 9
3.1.3 Anonymity or Pseudonymity of Subscribers ....................................................... 9
3.1.4 Rules for Interpreting Various Name Forms ...................................................... 9
3.1.5 Uniqueness of Names ........................................................................................... 9
3.1.6 Recognition, Authentication, and Roles of Trademarks .................................... 9
3.2 Initial Identity Validation ......................................................................................... 10
3.2.1 Method to Prove Possession of Private Key ...................................................... 10
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
II

Version.1.01
341-25-A001-01
3.2.2 Authentication of Organization Identity........................................................... 10
3.2.3 Authentication of Applicant and Individual Identity....................................... 10
3.2.4 Non-Verified Subscriber Information .................................................................11
3.2.5 Validation of Authority ........................................................................................11
3.2.6 Criteria for Interoperation ..................................................................................11
3.3 Identification and Authentication for Re-Key Requests..........................................11
3.3.1 Identification and Authentication for Routine Re-Key .....................................11
3.3.2 Identification and Authentication for Re-Key after Revocation.......................11
3.4 Identification and Authentication for Revocation Requests .................................. 12
4. Certificate Life-Cycle Operational Requirements ........................................................ 13
4.1 Certificate Application .............................................................................................. 13
4.1.1 Who May Submit a Certificate Application ...................................................... 13
4.1.2 Enrollment Process and Responsibilities.......................................................... 13
4.2 Certificate Application Processing ........................................................................... 13
4.2.1 Performing Identification and Authentication Functions ............................... 13
4.2.2 Approval or Rejection of Certificate Applications ............................................ 13
4.2.3 Time to Process Certificate Applications .......................................................... 14
4.3 Certificate Issuance................................................................................................... 14
4.3.1 CA Actions during Certificate Issuance ............................................................ 14
4.3.2 Notifications to Subscriber of Certificate Issuance .......................................... 14
4.4 Certificate Acceptance............................................................................................... 14
4.4.1 Conduct Constituting Certificate Acceptance................................................... 14
4.4.2 Publication of the Certificate by the CA ........................................................... 14
4.4.3 Notification of Certificate Issuance by the CA to Other Entities.................... 15
4.5 Key Pair and Certificate Usage................................................................................ 15
4.5.1 Subscriber Private Key and Certificate Usage ................................................. 15
4.5.2 Relying Party Public Key and Certificate Usage ............................................. 15
4.6 Certificate Renewal ................................................................................................... 15
4.6.1 Circumstances for Certificate Renewal ............................................................ 15
4.6.2 Who May Request Renewal ............................................................................... 15
4.6.3 Processing Certificate Renewal Requests ......................................................... 15
4.6.4 Notification of New Certificate Issuance to Subscriber ................................... 15
4.6.5 Conduct Constituting Acceptance of a Renewal Certificate ............................ 15
4.6.6 Publication of the Renewal Certificates by the CA .......................................... 16
4.6.7 Notification of Certificate Issuance by the CA to Other Entities.................... 16
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
III

Version.1.01
341-25-A001-01
4.7 Certificate renewal with Re-Key .............................................................................. 16
4.7.1 Circumstances for Certificate Re-Key ............................................................... 16
4.7.2 Who May Request Certification of a New Public Key...................................... 16
4.7.3 Processing Certificate Re-Keying Requests ...................................................... 16
4.7.4 Notification of New Certificate Issuance to Subscriber ................................... 16
4.7.5 Conduct Constituting Acceptance of a Re-Keyed Certificate .......................... 16
4.7.6 Publication of the Re-Keyed Certificate by the CA .......................................... 16
4.7.7 Notification of Certificate Issuance by the CA to Other Entities.................... 16
4.8 Certificate Modification ............................................................................................ 16
4.8.1 Circumstances for Certificate Modification ...................................................... 17
4.8.2 Who May Request Certificate Modification ...................................................... 17
4.8.3 Processing Certificate Modification Requests .................................................. 17
4.8.4 Notification of New Certificate Issuance to Subscriber ................................... 17
4.8.5 Conduct Constituting Acceptance of Modified Certificate ............................... 17
4.8.6 Publication of the Modified Certificates by the CA .......................................... 17
4.8.7 Notification of Certificate Issuance by the CA to Other Entities.................... 17
4.9 Certificate Revocation and Suspension ................................................................... 17
4.9.1 Circumstances for Certificate Revocation ........................................................ 17
4.9.2 Who Can Request Revocation ............................................................................ 18
4.9.3 Procedure for Revocation Request..................................................................... 18
4.9.4 Revocation Request Grace Period...................................................................... 18
4.9.5 Time within Which CA Shall Process the Revocation Request ....................... 19
4.9.6 Revocation Checking Requests .......................................................................... 19
4.9.7 CRL Issuance Frequency ................................................................................... 19
4.9.8 Maximum Latency for CRLs .............................................................................. 19
4.9.9 On-Line Revocation/Status Checking Availability ........................................... 19
4.9.10 On-Line Revocation/Status Checking Requirements..................................... 19
4.9.11 Other Forms of Revocation Advertisements Available................................... 19
4.9.12 Special Requirements Regarding Key Compromise ...................................... 19
4.9.13 Circumstances for Suspension Who Can Request Suspension ..................... 19
4.9.14 Who Can Request Suspension ......................................................................... 20
4.9.15 Procedure for Suspension Request .................................................................. 20
4.9.16 Limits on Suspension Period ........................................................................... 20
4.10 Certificate Status Services ..................................................................................... 20
4.10.1 Operational Characteristics............................................................................. 20
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
IV

Version.1.01
341-25-A001-01
4.10.2 Service Availability ........................................................................................... 20
4.10.3 Optional Features ............................................................................................. 20
4.11 End of Subscription (Registry) ............................................................................... 20
4.12 Key Escrow and Recovery ....................................................................................... 20
4.12.1 Key Escrow and Recovery Policy and Practices ............................................. 20
4.12.2 Session Key Encapsulation and Recovery Policy and Practices ................... 20
5. Facility, Management, and Operational Controls ........................................................ 21
5.1 Physical Controls....................................................................................................... 21
5.1.1 Site Location and Construction ......................................................................... 21
5.1.2 Physical Access ................................................................................................... 21
5.1.3 Power and Air Conditioning............................................................................... 21
5.1.4 Water Exposures ................................................................................................. 21
5.1.5 Fire Prevention and Protection ......................................................................... 21
5.1.6 Media Storage ..................................................................................................... 21
5.1.7 Waste Disposal .................................................................................................... 21
5.1.8 Off-Site Backup ................................................................................................... 21
5.2 Procedural Controls .................................................................................................. 21
5.2.1 Trusted Roles ...................................................................................................... 21
5.2.2 Number of Persons Required per Task ............................................................. 21
5.2.3 Identification and Authentication for Each Role.............................................. 22
5.2.4 Roles Requiring Separation of Duties ............................................................... 22
5.3 Personnel Controls .................................................................................................... 22
5.3.1 Qualifications, Experience, and Clearance Requirements .............................. 22
5.3.2 Background Check Procedures .......................................................................... 22
5.3.3 Training Requirements ...................................................................................... 22
5.3.4 Retraining Frequency and Requirements ........................................................ 22
5.3.5 Job Rotation Frequency and Sequence ............................................................. 22
5.3.6 Sanctions for Unauthorized Actions .................................................................. 22
5.3.7 Independent Contractor Requirements ............................................................ 22
5.3.8 Documentation Supplied to Personnel .............................................................. 22
5.4 Audit Logging Procedures......................................................................................... 22
5.4.1 Types of Events Recorded .................................................................................. 23
5.4.2 Frequency of Processing Audit Log ................................................................... 23
5.4.3 Retention Period for Audit Log .......................................................................... 23
5.4.4 Protection of Audit Log....................................................................................... 23
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
V

Version.1.01
341-25-A001-01
5.4.5 Audit Log Backup Procedure ............................................................................. 23
5.4.6 Audit Log Collection System .............................................................................. 23
5.4.7 Notification to Event-Causing Subject.............................................................. 23
5.4.8 Vulnerability Assessments ................................................................................. 23
5.5 Records Archival ........................................................................................................ 23
5.5.1 Types of Records Archived ................................................................................. 23
5.5.2 Retention Period for Archive.............................................................................. 24
5.5.3 Protection of Archive .......................................................................................... 24
5.5.4 Archive Backup Procedures ............................................................................... 24
5.5.5 Requirements for Time-Stamping of Records................................................... 24
5.5.6 Archive Collection System ................................................................................. 24
5.5.7 Procedures to Obtain and Verify Archive Information .................................... 24
5.6 Key Changeover ........................................................................................................ 24
5.7 Compromise and Disaster Recovery ........................................................................ 25
5.7.1 Incident and Compromise Handling Procedures ............................................. 25
5.7.2 Procedure when Hardware, Software, and/or Data are Corrupted ................ 25
5.7.3 Entity Private Key Compromise Procedures .................................................... 25
5.7.4 Business Continuity Capabilities after a Disaster .......................................... 25
5.8 CA or RA Termination ............................................................................................... 25
6. Technical Security Controls ........................................................................................... 26
6.1 Key Pair Generation and Installation ..................................................................... 26
6.1.1 Key Pair Generation ........................................................................................... 26
6.1.2 Private Key Delivery to Subscriber ................................................................... 26
6.1.3 Public Key Delivery to Certificate Issuer ......................................................... 26
6.1.4 CA Public Key Delivery to Relying Parties....................................................... 26
6.1.5 Key Sizes ............................................................................................................. 26
6.1.6 Public Key Parameters Generation and Quality Checking ............................. 26
6.1.7 Key Usage Purposes ........................................................................................... 26
6.2 Private Key Protection and Cryptographic Module Engineering Controls .......... 26
6.2.1 Cryptographic Module Standards and Controls .............................................. 27
6.2.2 Private Key Multi-Person Control..................................................................... 27
6.2.3 Private Key Escrow ............................................................................................ 27
6.2.4 Private Key Backup ............................................................................................ 27
6.2.5 Private Key Archive ............................................................................................ 27
6.2.6 Private Key Transfer into or from a Cryptographic Module ........................... 27
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
VI

Version.1.01
341-25-A001-01
6.2.7 Private Key Storage on Cryptographic Module................................................ 27
6.2.8 Method of Activating Private Key ..................................................................... 27
6.2.9 Method of Deactivating Private Key ................................................................. 28
6.2.10 Method of Destroying Private Key .................................................................. 28
6.2.11 Cryptographic Module Rating.......................................................................... 28
6.3 Other Aspects of Key Pair Management ................................................................. 28
6.3.1 Public Key Archival ............................................................................................ 28
6.3.2 Certificate Operational Periods and Key Pair Usage Periods ........................ 28
6.4 Activation Data .......................................................................................................... 28
6.4.1 Activation Data Generation and Installation ................................................... 28
6.4.2 Activation Data Protection ................................................................................. 28
6.4.3 Other Aspects of Activation Data ...................................................................... 29
6.5 Computer Security Controls ..................................................................................... 29
6.5.1 Specific Computer Security Technical Requirements ...................................... 29
6.5.2 Computer Security Rating ................................................................................. 29
6.6 Life-Cycle Security Controls ..................................................................................... 29
6.6.1 System Development Controls........................................................................... 29
6.6.2 Security Management Controls ......................................................................... 29
6.6.3 Life-Cycle Security Controls .............................................................................. 29
6.7 Network Security Controls ....................................................................................... 29
6.8 Time-Stamping .......................................................................................................... 29
7. Certificate, CRL, and OCSP Profiles ............................................................................. 30
7.1 Certificate Profile ...................................................................................................... 30
7.1.1 Version Number(s) .............................................................................................. 33
7.1.2 Certificate Extension .......................................................................................... 33
7.1.3 Algorithm Object Identifier ................................................................................ 33
7.1.4 Name Format ...................................................................................................... 33
7.1.5 Name Constraints............................................................................................... 33
7.1.6 Certificate Policy Object Identifier .................................................................... 33
7.1.7 Use of Policy Constraint Extensions ................................................................. 33
7.1.8 Policy Qualifier Syntax and Semantics ............................................................ 33
7.1.9 How to interpret Critical Certificate Policy Extensions .................................. 34
7.2 CRL Profile ................................................................................................................ 34
7.2.1 Version Number(s) .............................................................................................. 34
7.2.2 Certificate Revocation Lists and CRL Entry Extensions ................................ 35
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
VII

Version.1.01
341-25-A001-01
7.3 OCSP Profile .............................................................................................................. 35
7.3.1 Version Number(s) .............................................................................................. 35
7.3.2 OCSP Extensions ................................................................................................ 35
8. Compliance Audit and Other Assessments ................................................................... 36
8.1 Frequency and Circumstances of Assessment ........................................................ 36
8.2 Identity/Qualifications of Assessor .......................................................................... 36
8.3 Assessor’s Relationship to Assessed Entity ............................................................. 36
8.4 Topics Covered by Assessment ................................................................................. 36
8.5 Actions Taken as a Result of Deficiency .................................................................. 36
8.6 Communication of Results ........................................................................................ 36
9. Other Business and Legal Matters ................................................................................ 37
9.1 Fees ............................................................................................................................ 37
9.1.1 Fees for Issuing or Renewing Certificates ........................................................ 37
9.1.2 Certificate Access Fee ......................................................................................... 37
9.1.3 Expiration or Access Fee for Status Information ............................................. 37
9.1.4 Fees for Other Services ...................................................................................... 37
9.1.5 Refund Policy ...................................................................................................... 37
9.2 Financial Responsibility ........................................................................................... 37
9.2.1 Insurance Coverage ............................................................................................ 37
9.2.2 Other Assets ........................................................................................................ 37
9.2.3 End entity Insurance or Warranty coverage .................................................... 37
9.3 Confidentiality of Business Information ................................................................. 37
9.3.1 Scope of Confidential Information ..................................................................... 37
9.3.2 Information Not Within the Scope of Confidential Information ..................... 38
9.3.3 Responsibility to Protect Confidential Information ......................................... 38
9.4 Privacy of Personal Information .............................................................................. 38
9.4.1 Personal Information Protection Plan .............................................................. 38
9.4.2 Information Treated as Personal Information.................................................. 38
9.4.3 Information that is not considered Personal Information ............................... 38
9.4.4 Responsibility for protecting Personal Information ......................................... 38
9.4.5 Notice and Consent regarding use of Personal Information ........................... 38
9.4.6 Disclosure of Information in accordance with Judicial or Administrative ..... 38
Procedures .................................................................................................................... 38
9.4.7 Other Information Disclosure Conditions ........................................................ 38
9.5 Intellectual Property Rights ..................................................................................... 38
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
VIII

Version.1.01
341-25-A001-01
9.6 Representations and Warranties ............................................................................. 39
9.6.1 CA Representation and Warranties .................................................................. 39
9.6.2 RA Representations and Warranties ................................................................. 39
9.6.3 Applicant and Subscriber Representations and Warranties ........................... 40
9.6.4 Relying Party Representations and Warranties .............................................. 40
9.6.5 Representations and Warranties of Other Participants .................................. 40
9.7 Disclaimer of Warranties .......................................................................................... 40
9.8 Limitations of Liability ............................................................................................. 40
9.9 Indemnities ................................................................................................................ 41
9.10 Term and Termination ............................................................................................ 41
9.10.1 Term ................................................................................................................... 41
9.10.2 Termination ....................................................................................................... 41
9.10.3 Effect of Termination and Survival ................................................................. 42
9.11 Individual Notices and Communications with Participants ................................ 42
9.12 Amendments ............................................................................................................ 42
9.12.1 Procedure for Amendment ............................................................................... 42
9.12.2 Notification Method and Timing ..................................................................... 42
9.12.3 Circumstances under Which OID Must Be Changed .................................... 42
9.13 Dispute Resolution Procedures .............................................................................. 42
9.14 Governing Law ........................................................................................................ 43
9.15 Compliance with Applicable Law ........................................................................... 43
9.16 Miscellaneous Provisions ........................................................................................ 43
9.16.1 Entire Agreement ............................................................................................. 43
9.16.2 Assignment ........................................................................................................ 43
9.16.3 Severability ....................................................................................................... 43
9.16.4 Enforcement ...................................................................................................... 43
9.16.5 Irresistible Force............................................................................................... 43
9.17 Other Provisions ...................................................................................................... 44

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
IX

Version.1.01
341-25-A001-01
1. Introduction
1.1 Overview
SECOM Passport Plus Certificate Policy (hereinafter, "this CP") defines the policy on
certificates issued by SECOM Passport Plus CA (hereinafter, "the CA"), which areoperated by SECOM Trust Systems Co., Ltd. (hereinafter, "SECOM Trust Systems"),by specifying the purpose of use, the scope of application and user procedures
concerning the Certificates. Various procedures regarding the operation andmaintenance of the CA are stipulated in the SECOM Digital Certification
Infrastructure Certification Practice Statement (hereinafter, "CPS").
The CA has been issued a one-way cross-certification certificate by Security
Communication RootCA2 and is operated according to the operational standards set
by each CA. The above CA's CP and CPS are published in the following repositories.
・Security communication route CA2
https://repository.secomtrust.net/SC-Root2/index.html
A party seeking to obtain Certificates from the CA must examine its usage purposes
against this CP and the CPS, and agree to the both prior to getting the Certificatesissued.
This CP shall be revised as necessary in order to reflect any technical or operational
developments or improvements pertaining to the CA.
This CP conforms to the RFC3647 "Internet X.509 Public Key Infrastructure
Certificate Policy and Certification Practices Framework" advocated by the IETF as a
CA practice framework.
In the event of a conflict between this CP and the CPS, the order of precedence in theapplication thereof shall be this CP, and the CPS. Any provisions set forth in a separate
contract or the like between SECOM Trust Systems and an organization, a group or
any other party, with which it has a contractual relationship that are inconsistent withthis CP or the CPS, shall prevail.

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-1

Version.1.01
341-25-A001-01
1.2 Document Name and Identification
The official name of this CP is "SECOM Passport Plus Certificate Policy". This CP is
assigned a registered unique object identifier (hereinafter referred to as “OID”) for eachuse of the issued certificate. The OID of this CP herein referenced are as follows:
CP/CPSSECOM Passport Plus Type A Policy for Natural
Persons (Corporations/Organizations)
SECOM Passport Plus Type A Policy for Natural
persons (individuals)
SECOM Passport Plus Type B Policy for Natural
Persons (Corporations/Organizations)
SECOM Passport Plus Type B Policy for
Corporations/Organizations
SECOM Digital Certification Infrastructure
Certification Practice StatementOID
1.2.392.200091.100.898.1
1.2.392.200091.100.898.2
1.2.392.200091.100.898.3
1.2.392.200091.100.898.4
1.2.392.200091.100.401.1

1.3 PKI Participants
1.3.1 CACA performs administration of the CA's private key, issuance/revocation of Certificates,
publication of CRLs (Certificate Revocation Lists), and maintenance/administration of
the repository. The operating body of the CA on the Digital Certification Infrastructure
is SECOM Trust Systems.
1.3.2 RAThe RA is an entity that performs the examination of LRA (Local Registration
Authority) and certificate subscribers, and the registration work for issuing andrevoking certificates. In the CA operated on the Digital Certification Infrastructure,
the operation of RA is performed by SECOM Trust Systems.
The LRA is the entity that performs, on behalf of the RA, verification of the existenceof the certificate subscriber and verification of the identity, registration of thecertificate for issuing and revoking the certificate, and the like. A special organizationor entity that has been reviewed by the RA in advance and confirmed by the RA canplay that role.
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-2

Version.1.01
341-25-A001-01
The LRA, like the RA, shall comply with the matters stipulated in this CP. Note that
the LRA may perform a task
1.3.3 Applicants and Subscribers
Applicants shall mean an individual, corporations or any other organizations, etc. thatapplies to RA or LRA for issuance or revocation of a certificate, and certificate
subscribers shall refer to an individual, corporations or any other organizations thatreceives a certificate issued by the CA and uses the certificate.
1.3.4 Relying Parties
Relying Parties are an individual, corporations or any other organizations that verifies
the validity of a certificate issued by the CA.
1.3.5 Other Parties
Other Parties include auditors that check the compliance of the CA, companies andorganizations that have service contracts with SECOM Trust Systems, and companies
that perform system integration.
1.4 Certificate Usage
1.4.1 Appropriate Certificate Uses
The certificate issued by the CA under this CP can be used for the purposes specified
in the Key Usage and Extended Key Usage fields listed in the certificate.
1.4.2 Prohibited Certificate Uses
Certificates issued by the CA based on this CP must not be used for any purpose otherthan those described in "1.4.1 Appropriate Certificate Uses".
1.5 Policy Administration
1.5.1 Organization Administering the Document
This CP is maintained and administered by SECOM Trust Systems.
1.5.2 Contact Information
Contact information for this CP is as follows:
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-3

Version.1.01
341-25-A001-01
SECOM Trust Systems Co., Ltd.
E-mail address: ca-support@secom.co.jp
Website: https://www.secomtrust.net/
The Subscribers, Relying Parties, Application Software Suppliers, and other third
parties can report suspected Private Key Compromise, Certificate misuse, or othertypes of fraud, compromise, misuse, inappropriate conduct, or any other matter related
to Certificates. The CA revokes certificates when it is determined that it needs to be
revoked.
1.5.3 Person Determining CP Suitability for the Policy
The Certification Services Improvement Committee determines the suitability of thecontents of this CP.
1.5.4 Approval Procedure
This CP is prepared and revised by SECOM Trust Systems and goes into effect upon
approval by the Certification Services Improvement Committee.
1.6 Definitions and Acronyms
A～Z
Archive
Information obtained for the purpose of preserving history for legal or other reasons.
Audit Log
Behavioral, access and other histories pertaining to the CA systems which are recorded
for inspection of access to and unauthorized operation of the CA systems.
CA（Certification Authority）
An entity that mainly issues, renews and revokes Certificates, generates and protects
CA Private Keys, and registers Subscribers.
Certification Service Improvement Committee
A decision-making organization that manages this CP, considers changes, andSecom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-4

Version.1.01
341-25-A001-01
determines the operational policy for this service.
CP（Certificate Policy）
A document that sets forth provisions pertaining to Certificates issued by a CA,
including Certificate types, usage and application procedure.
CPS（Certification Practices Statement）：
A document that sets forth provisions pertaining to the practices of CAs, including
procedures for the CA operations and the security standards.
CRL（Certificate Revocation List）：
A list of information on Certificates which were revoked prior to their expiration due
to reasons such as changes to the information provided in the Certificates and loss of
the relevant Private Key.
Digital Certificate
Digital data certifying that a public key is owned by the party specified, validity ofwhich is certified by the digital signature of the relevant CA affixed thereto.
Escrow
Escrow means the placement (entrustment) of an asset in the control of an
independent third party.
FIPS140-2
The security certification standards developed by the U.S. NIST (National Institute ofStandards and Technology) for cryptographic modules, defining four security levels,the lowest 1 through the highest 4.
HSM（Hardware Security Module）
A tamper-resistant cryptographic module used to ensure the security mainly ingeneration, storage and usage of private keys.
Key PairA pair of keys comprising a private key and a public key in the public key cryptosystem.

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-5

Version.1.01
341-25-A001-01

LRA Operating Standards
A document that describes the standards to be followed by the LRA for the organization,
operations, facilities, and audits when performing LRA operations.
OID（Object Identifier）：
A unique numeric identifier registered by the international registration authority, ina framework to maintain and administer the uniqueness of the mutual connectivity,
services and other aspects of the networks.
PKI（Public Key Infrastructure）
An infrastructure for use of the encryption technology known as the public key
cryptosystem to realize such security technologies as digital signature, encryption andcertification.
Private Key
A key comprising a Key Pair used in the public key cryptosystem, which corresponds
to a Public Key and is possessed only by the relevant Subscriber.
Public Key
A key of a Key Pair used in the Public Key cryptosystem. A Public Key corresponds to
the Private Key and is published to and shared with the recipient.
RA（Registration Authority）
An entity which, of the duties of a CA, mainly performs assessment of application
submissions, registration of necessary information for issuance of the Certificates,requests Certificate issuance to CAs.
Repository
A (online) database for storing and providing access to CA certificates, CRLs and thelike.
RFC3647（Request For Comments 3647）
A document defining the framework for CP and CPS published by the IETF (TheInternet Engineering Task Force), an industry group which establishes technical
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-6

Version.1.01
341-25-A001-01
standards for the Internet.
RSA
One of the most standard encryption technologies widely used in the Public Key
cryptosystem.
Time-Stamp
Data recording such date and time of creating an electronic file or running a systemprocess.
X.500
A series of computer network standards regarding the decentralized directory service.

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-7

Version.1.01
341-25-A001-01
2. Publication and Repository Responsibilities
2.1 Repository
SECOM Trust Systems maintains and manages a Repository in order to allow
Subscribers and Relying Parties to access CRL, this CP and CPS information 24x7.
2.2 Publication of Certificate Information
SECOM Trust Systems stores the following information in the Repository to allow theonline access thereto by Subscribers:
・ CRL
・ The CA Intermediate Certificates・ The latest versions of this CP and the CPS
・ Other information pertaining to Certificates issued by the CA
2.3 Time or Frequency of Publication
This CP and the CPS are published in the Repository as revised. A CRL containing
information of revocation processed conforming to this CP is published in the
Repository as issued. Certificates with expired validity period shall be removed fromthe CRL.
2.4 Access Controls on Repository
The CA makes its Repository publicly available in a read-only manner. In the CA, only
the authorized CA administrators can perform operations such as adding, deleting,modifying, and publishing Repositories.

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-8

Version.1.01
341-25-A001-01
3. Identification and Authentication
3.1 Naming
3.1.1 Types of Names
The certificate issued by the CA meets the requirements of the X.509 standard,
RFC5280 standard, and the distinguished name assigned to the certificate holder is
set according to the X.500 distinguished name format.
3.1.2 Need for Names to Be Meaningful
The Distinguished Name used for the certificate issued by the CA shall be used to
identify the Subscriber and shall be meaningful.
3.1.3 Anonymity or Pseudonymity of Subscribers
Anonymous or pseudonym registration is not performed for the organization name andcommon name of the certificate issued by the CA. A number or a character string for
managing a certificate may be registered.
3.1.4 Rules for Interpreting Various Name Forms
Rules concerning the interpretation of various name forms are governed by the X.500
Series DN rules.
3.1.5 Uniqueness of Names
In the CA, the issued certificate guarantees that the certificate owner can be uniquely
identified by the information contained in the Distinguished Name of the Subject.
The serial number of the certificate shall be the serial number including random
numbers generated by CSPRNG. Serial numbers assigned in the CA are unique.
3.1.6 Recognition, Authentication, and Roles of Trademarks
SECOM Trust Systems will confirm, as necessary, whether it has intellectual property
rights for the name indicated in the certificate application. Subscribers must not apply
for a registered trademark or related name of a third party to the CA. SECOM Trust
Systems will not arbitrate or engage itself in the resolution of any dispute between
Subscribers and third parties over the registered trademark or any alike. SECOM
Trust Systems reserves the right to revoke an issued Certificate due to the dispute.
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-9

Version.1.01
341-25-A001-01

3.2 Initial Identity Validation
3.2.1 Method to Prove Possession of Private Key
SECOM Trust Systems verifies the signature of the certificate issuance request in thecertificate application procedure, and confirms that it is signed with the private key
corresponding to the public key included in the certificate issuance request.
3.2.2 Authentication of Organization Identity
SECOM Trust Systems authenticates the identity of LRA or corporations, andorganizations based on official documents issued by national or local governments,
investigations conducted, or databases owned by third parties that SECOM Trust
Systems trusts, or through other means deemed equally trustworthy by the
Certification Services Improvement Committee.
In the case of certification using public documents issued by the national or local
governments, a seal certificate (within three months from the date of issuance) or
equivalent documents must be submitted.
Documents to be submitted to SECOM Trust Systems at the time of LRA ororganization/corporation screening are as follows:・ Documents that report information on LRA or organizations, corporations, etc.
・ Other documents required by SECOM Trust Systems at the time of screening
As a result of the examination, If SECOM Trust Systems determines that it is nonconforming, the submitted official documents will be returned or destroyed.

If

SECOM Trust Systems has received the application form, SECOM shall destroy it.
3.2.3

Authentication of Applicant and Individual Identity

SECOM Trust Systems authenticates the identity of applicants or individuals basedon official documents issued by national or local governments, investigations
conducted, or databases owned by third parties that SECOM Trust Systems trusts, or
through other means deemed equally trustworthy by the Certification Services
Improvement Committee. It shall be authenticated by one of the following methods:
1. Confirm the seal of the application received in writing.
2. Use public documents to verify the identity.
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-10

Version.1.01
341-25-A001-01
3. Based on the information from a trusted third party, a challenge-response will bedone for the applicant by postal mail.
4. Based on the information from a trusted third party, a challenge-response will bedone for the applicant by phone.
5. Based on the information from a trusted third party, a challenge-response will bedone for the applicant by Email.
LRA may authenticate an applicant and a subscriber based on the LRA operational
standards.
3.2.4 Non-Verified Subscriber Information
SECOM Trust Systems verifies all information specified such as the trade name, name,and location of the certificate subscriber included in the certificate's distinguishedname in accordance with "3.2.2 Authentication of Organization Identity" and "3.2.3
Authentication of applicant and certificate subscriber”. In addition, in providing theservice, there is a case where it is requested to provide information necessary for officeprocedures such as billing information.
3.2.5 Validation of Authority
The legitimacy of authority for the applicant is authenticated in accordance with "3.2.2
Authentication of Organization Identity" and "3.2.3 Authentication of applicant andcertificate subscriber” hereof.
3.2.6 Criteria for Interoperation
Unilateral cross-certificate by Security Communication RootCA2 has been issued to
the CA.
3.3 Identification and Authentication for Re-Key Requests
3.3.1 Identification and Authentication for Routine Re-Key
Shall be in the same manner as set forth in “3.2.3 Authentication of Applicant andIndividual Identity” and “3.2.5 Validation of Authority”.
3.3.2 Identification and Authentication for Re-Key after Revocation
Shall be in the same manner as set forth in “3.2.3 Authentication of Applicant andSecom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-11

Version.1.01
341-25-A001-01
Individual Identity” and “3.2.5 Validation of Authority”.
3.4 Identification and Authentication for Revocation Requests
Shall be in the same manner as set forth in “3.2.3 Authentication of Applicant andIndividual Identity” and “3.2.5 Validation of Authority”.

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-12

Version.1.01
341-25-A001-01
4. Certificate Life-Cycle Operational Requirements
4.1 Certificate Application
4.1.1 Who May Submit a Certificate Application
An application for the CA can be made by an LRA, corporation, or organization thathas been certified by SECOM Trust Systems based on “3.2.2 Authentication ofOrganization Identity”.
Applications for LRA can be made by persons specified by LRA based on the LRA
operational standards.
4.1.2 Enrollment Process and Responsibilities
In submitting a Certificate Application, a Subscriber or an Applicant to perform theapplication procedure shall agree to the provisions of this CP, and the CPS before
proceeding with the application, as well as certify that the information submitted isaccurate.
4.2 Certificate Application Processing
4.2.1 Performing Identification and Authentication Functions
SECOM Trust Systems performs identity verification and authentication of the LRAor the corporation, organization in accordance with “3.2 Initial Identification andAuthentication”. In applying for a certificate accepted from the LRA, LRA identity
verification and authentication shall be done according to the method determined by
Certification Service Improvement Committee.
The LRA performs identity verification and authentication based on the LRA
operational standards in the manner determined by the LRA.
4.2.2 Approval or Rejection of Certificate Applications
The CA or LRA issues a certificate for the application that has been approved as aresult of the review. In addition, it shall be possible to reject a certificate application
for which the examination of all items is not completed successfully, and reject any
certificate that includes the following reasons:・Certificate of the applicant or the subscriber that was previously rejected orpreviously violated the terms of the agreement
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-13

Version.1.01
341-25-A001-01

4.2.3

Time to Process Certificate Applications

After accepting the certificate application, the CA shall immediately enable the LRA,
the certificate subscriber or the applicant to obtain the certificate.
4.3 Certificate Issuance
4.3.1 CA Actions during Certificate Issuance
The CA issues a certificate signed using the CA's private key based on the application
information.
Subordinate CA certificate issuance by the Root CA shall require an individual
authorized by the CA (i.e. the CA system operator, system officer, or PKI
administrator) to deliberately issue a direct command in order for the Root CA toperform a certificate signing operation.
The CA enforce multi-factor authentication for all accounts capable of directly causing
certificate issuance.
The backdating of a certificate's notBefore date to avoid a deadline, prohibition or codeenforced restriction is not used by the CA.
4.3.2 Notifications to Subscriber of Certificate Issuance
After the issuance of the certificate for the received application is completed, the CA
distributes the issued certificate online or offline to the LRA, the certificate subscriber,or the applicant. Notification of certificate issuance is made by distributing thecertificate.
4.4 Certificate Acceptance
4.4.1 Conduct Constituting Certificate AcceptanceIf the CA receives a report for receipt from the LRA or the Subscriber, or if no objection
is made within 14 days of the CA's distribution of the Certificate, consider that the
LRA or Subscriber has received the certificate.
4.4.2 Publication of the Certificate by the CA
The CA does not publish Subscriber Certificates.

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-14

Version.1.01
341-25-A001-01
4.4.3 Notification of Certificate Issuance by the CA to Other Entities
The CA will not send a notice of Certificate issuance to entities other than the person
in charge, who was registered at the time of the Certificate Application submission.
4.5 Key Pair and Certificate Usage
4.5.1 Subscriber Private Key and Certificate Usage
The use of the private key and certificate of the Subscribers shall be in accordancewith “1.4.1 Appropriate Certificate Uses” and the terms and conditions. The
Subscribers shall use the certificate and the corresponding private key for the purpose
described in "1.4.1 Appropriate Certificate Uses" and the terms and conditions.
4.5.2 Relying Party Public Key and Certificate Usage
Relying Parties can use the public key and certificate of the Subscribers to verify theauthenticity of the certificate issued by the CA. Relying Parties must understands andaccepts the contents of this CP and CPS before using the CA's certificate.
4.6 Certificate Renewal
The CA recommends generating a new Key Pair when Subscribers renew a Certificate.
4.6.1 Circumstances for Certificate Renewal
No stipulation
4.6.2 Who May Request Renewal
No stipulation
4.6.3 Processing Certificate Renewal Requests
No stipulation
4.6.4 Notification of New Certificate Issuance to Subscriber
No stipulation
4.6.5 Conduct Constituting Acceptance of a Renewal Certificate
No stipulation

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-15

Version.1.01
341-25-A001-01
4.6.6 Publication of the Renewal Certificates by the CA
No stipulation
4.6.7 Notification of Certificate Issuance by the CA to Other Entities
No stipulation
4.7 Certificate renewal with Re-Key
4.7.1 Circumstances for Certificate Re-Key
Renewal of a certificate with a key is performed when the validity period of thecertificate expires or when the certificate is revoked due to compromise of the key.
4.7.2 Who May Request Certification of a New Public Key
Shall be same as “4.1.1 Who May Submit a Certificate Application”.
4.7.3 Processing Certificate Re-Keying Requests
Shall be same as “4.3.1 CA Actions during Certificate Issuance”.
4.7.4 Notification of New Certificate Issuance to Subscriber
Shall be same as “4.3.2 Notifications to Subscriber of Certificate Issuance”.
4.7.5 Conduct Constituting Acceptance of a Re-Keyed Certificate
Shall be same as “4.4.1 Conduct Constituting Certificate Acceptance”.
4.7.6 Publication of the Re-Keyed Certificate by the CA
Shall be same as “4.4.2 Publication of the Certificate by the CA”.
4.7.7 Notification of Certificate Issuance by the CA to Other Entities
Shall be same as “4.4.3 Notification of Certificate Issuance by the CA to Other Entities”
4.8 Certificate Modification
If there is any change in the information on the certificate, Subscribers must promptly
apply for the change. The procedure for the change shall be the same as that for the
first issue. After the certificate is changed, the certificate before the change shall be
revoked immediately.
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-16

Version.1.01
341-25-A001-01

4.8.1 Circumstances for Certificate Modification
No stipulation
4.8.2 Who May Request Certificate Modification
Shall be same as “4.1.1 Who May Submit a Certificate Application”.
4.8.3 Processing Certificate Modification Requests
Shall be same as “4.3.1 CA Actions during Certificate Issuance”. The revocation of
the certificate before the change shall be the same as in “4.9.3 Procedure for Revocation
Request”.
4.8.4 Notification of New Certificate Issuance to Subscriber
Shall be same as “4.3.2 Notifications to Subscriber of Certificate Issuance”.
4.8.5 Conduct Constituting Acceptance of Modified Certificate
Shall be same as “4.4.1 Conduct Constituting Certificate Acceptance”.
4.8.6 Publication of the Modified Certificates by the CA
Shall be same as “4.4.2 Publication of the Certificate by the CA”.
4.8.7 Notification of Certificate Issuance by the CA to Other Entities
No stipulation
4.9 Certificate Revocation and Suspension
4.9.1 Circumstances for Certificate Revocation
A Subscriber must promptly request the CA to revoke a Certificate in the event of anyof the following:
・ There has been a change in information populated in the Certificate;・ The Private Key has or may have been compromised for any reason, including
the theft, loss, unauthorized disclosure or unauthorized use thereof;
・ The Certificate is incorrectly populated or not being used for authorized purposes;
・ The use of the Certificate is being terminated.

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-17

Version.1.01
341-25-A001-01
SECOM Trust Systems may revoke the Subscriber Certificate at its discretion in theevent of any of the following:
・ The Subscriber is not performing the obligations thereof set forth in this CP, the
CPS, relevant agreements or laws;
・ When it has been determined that the Subscriber has been refused to issue acertificate or has been revoked to breach of contract or other reasons;・ When it is determined that the private key of the Subscriber and the CA has been
compromised or may be compromised;
・ It is recognized that the certificate was used for a purpose other than the properuse described in this CP, or was used for a purpose other than that indicated in
the contract with SECOM Trust Systems, or the certificate was misused in otherways;
・ When it is recognized that a change in the information contained in thecertificate;・ When it is recognized that the certificate of the Subscriber has been illegally
accessed;
・ SECOM Trust Systems recognizes any other situation deemed to necessitate
revocation.
4.9.2 Who Can Request Revocation
Shall be same as “4.1.1 Who May Submit a Certificate Application”.
4.9.3 Procedure for Revocation Request
A Subscriber submits a revocation request for the Subscriber certificate to the CA
according to the prescribed procedure. For the certificates requested and issued by the
LRA, a revocation request for a Subscriber certificate shall be made by the method
determined by the LRA based on the LRA operational standards.
LRA identity verification and authentication shall be done according to the method
determined by Certification Service Improvement Committee, and applies forrevocation of the Subscriber certificate to the CA.
4.9.4 Revocation Request Grace Period
The Subscriber must apply for revocation immediately after the cause of the certificate
revocation.
The LRA must apply for revocation to the CA immediately after receiving theSecom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-18

Version.1.01
341-25-A001-01
application from the Subscriber.
4.9.5 Time within Which CA Shall Process the Revocation Request
Upon receipt of a valid Revocation Request, the CA will promptly process the request
and reflect the relevant Certificate information in the CRL.
4.9.6 Revocation Checking Requests
In the certificate issued by the CA, describe the URL where the CRL is stored. Relying
Parties must authenticate the validity of a Subscriber Certificate. The validity of a
Certificate may be verified by using the CRL posted on the Repository site.
4.9.7 CRL Issuance Frequency
The CA will issue a CRL within 24 hours, regardless of whether there has been a
revocation processed or not. When a certificate is revoked, a CRL is issued immediately
and reflected in the repository.
4.9.8 Maximum Latency for CRLs
The CRLs issued by the CA are immediately reflected onto the Repository.
4.9.9 On-Line Revocation/Status Checking Availability
No stipulation
4.9.10 On-Line Revocation/Status Checking Requirements
No stipulation
4.9.11 Other Forms of Revocation Advertisements Available
No stipulation
4.9.12 Special Requirements Regarding Key Compromise
Refer to “4.9.1. Circumstances for Certificate Revocation”.
4.9.13 Circumstances for Suspension Who Can Request Suspension
The CA does not suspend certificates.

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-19

Version.1.01
341-25-A001-01

4.9.14 Who Can Request Suspension
Not applicable.
4.9.15 Procedure for Suspension Request
Not applicable.
4.9.16 Limits on Suspension Period
Not applicable.
4.10 Certificate Status Services
4.10.1 Operational Characteristics
The revocation information of the CRL shall be confirmed until the expiration datewritten on the revoked certificate.
4.10.2 Service Availability
The CA maintains and manages the CRL in order to allow 24x7 access to theCertificate status for confirmation.
4.10.3 Optional Features
No stipulation
4.11 End of Subscription (Registry)
When terminating the use of this service, the LRA or the Subscriber must apply forrevocation of the issued certificate.
4.12 Key Escrow and Recovery
4.12.1 Key Escrow and Recovery Policy and Practices
The CA does not Escrow Subscriber Private Keys.
4.12.2 Session Key Encapsulation and Recovery Policy and Practices
Not applicable.

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-20

Version.1.01
341-25-A001-01
5. Facility, Management, and Operational Controls
5.1 Physical Controls
5.1.1 Site Location and Construction
Relevant provisions are stipulated in the CPS.
5.1.2 Physical Access
Relevant provisions are stipulated in the CPS.
5.1.3 Power and Air Conditioning
Relevant provisions are stipulated in the CPS.
5.1.4 Water Exposures
Relevant provisions are stipulated in the CPS.
5.1.5 Fire Prevention and Protection
Relevant provisions are stipulated in the CPS.
5.1.6 Media Storage
Relevant provisions are stipulated in the CPS.
5.1.7 Waste Disposal
Relevant provisions are stipulated in the CPS.
5.1.8 Off-Site Backup
Relevant provisions are stipulated in the CPS.
5.2 Procedural Controls
5.2.1 Trusted Roles
Relevant provisions are stipulated in the CPS.
5.2.2 Number of Persons Required per Task
Relevant provisions are stipulated in the CPS.
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-21

Version.1.01
341-25-A001-01

5.2.3 Identification and Authentication for Each Role
Relevant provisions are stipulated in the CPS.
5.2.4 Roles Requiring Separation of Duties
Relevant provisions are stipulated in the CPS.
5.3 Personnel Controls
5.3.1 Qualifications, Experience, and Clearance Requirements
Relevant provisions are stipulated in the CPS.
5.3.2 Background Check Procedures
Relevant provisions are stipulated in the CPS.
5.3.3 Training Requirements
Relevant provisions are stipulated in the CPS.
5.3.4 Retraining Frequency and Requirements
Relevant provisions are stipulated in the CPS.
5.3.5 Job Rotation Frequency and Sequence
Relevant provisions are stipulated in the CPS.
5.3.6 Sanctions for Unauthorized Actions
Relevant provisions are stipulated in the CPS.
5.3.7 Independent Contractor Requirements
Relevant provisions are stipulated in the CPS.
5.3.8 Documentation Supplied to Personnel
Relevant provisions are stipulated in the CPS.
5.4 Audit Logging Procedures

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-22

Version.1.01
341-25-A001-01
5.4.1 Types of Events Recorded
Relevant provisions are stipulated in the CPS.
5.4.2 Frequency of Processing Audit Log
Relevant provisions are stipulated in the CPS.
5.4.3 Retention Period for Audit Log
Relevant provisions are stipulated in the CPS.
5.4.4 Protection of Audit Log
Relevant provisions are stipulated in the CPS.
5.4.5 Audit Log Backup Procedure
Relevant provisions are stipulated in the CPS.
5.4.6 Audit Log Collection System
Relevant provisions are stipulated in the CPS.
5.4.7 Notification to Event-Causing Subject
Relevant provisions are stipulated in the CPS.
5.4.8 Vulnerability Assessments
Relevant provisions are stipulated in the CPS.
5.5 Records Archival
5.5.1 Types of Records Archived
SECOM Trust Systems stores the following information in addition to logs related tosystems specified in "5.4.1 Types of Events Recorded" in the CPS, as Archive:・ This CP;・ Documents associated with agreements of subcontracting if the certification
services are outsourced;
・ Application documents from LRA or corporations, organizations, etc.;

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-23

Version.1.01
341-25-A001-01

5.5.2 Retention Period for Archive
SECOM Trust Systems retains its Archive for a minimum of seven (7) years after thecertificate issued by the CA ceased to be valid, and the ones related to the operation of
the CA after the last certificate issued by the CA ceased to be valid.
5.5.3 Protection of Archive
The Archive is retained in a facility, to which access is restricted to the authorized
personnel.
5.5.4 Archive Backup ProceduresIf critical data regarding the system is changed, the Archive is backed up in a timely
manner.
5.5.5 Requirements for Time-Stamping of Records
SECOM Trust Systems uses the NTP (Network Time Protocol) to time synchronize
systems and Time-Stamps critical information recorded therein.
5.5.6 Archive Collection System
The Archive collection system is included as a function of the systems.
5.5.7 Procedures to Obtain and Verify Archive Information
The Archive shall be retrieved from the secure storage by designated personnel withthe appropriate access permission for periodic checks of the storage conditions of themedia. Further, the Archive is copied to new media as appropriate to maintain theirintegrity and confidentiality.
5.6 Key Changeover
Before the remaining validity period of a Certificate corresponding to the CA Private
Key becomes shorter than the maximum validity period of the Certificate issued to a
Subscriber, a new Private Key is generated in its stead and a new Certificate is issued.
Once a new Private Key is generated, Certificates and CRLs are issued using the new
Private Key.

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-24

Version.1.01
341-25-A001-01

5.7 Compromise and Disaster Recovery
5.7.1 Incident and Compromise Handling Procedures
SECOM Trust Systems establishes measures against incidents and compromises,
including the following, to ensure the prompt recovery of the system and relevant
operations thereafter:
・ CA Private Key compromise;・ Damages to or malfunction of hardware, software, and/or data; and・ Fires, earthquakes and other disasters.
5.7.2 Procedure when Hardware, Software, and/or Data are Corrupted
In the event of damage to any hardware, software or data of the system, SECOM Trust
Systems promptly engages in the system recovery efforts using the relevant hardware,
software or data that it retains as backup.
5.7.3 Entity Private Key Compromise Procedures
Should it be determined that the CA Private Keys have been or may be compromisedor should a disaster or any other unexpected incidents result in a situation that may
lead to interruptions or suspensions of the operation of the system, SECOM Trust
Systems follows the predetermined plans and procedures to securely resume theoperation.
5.7.4 Business Continuity Capabilities after a DisasterIn order to ensure prompt recovery to be implemented in the event of an unforeseen
circumstance, SECOM Trust Systems deploys preventive measures for the fastest
possible recovery of the system, including securing of replacement/backup hardware,continual data backups for recovery, and establishment of the recovery procedures.
5.8 CA or RA Termination
In the event of termination of the CA by SECOM Trust Systems, the company shall so
notify LRA, the service contractor. All Certificates issued by the CA are revoked prior
to the termination thereof.

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-25

Version.1.01
341-25-A001-01
6. Technical Security Controls
6.1 Key Pair Generation and Installation
6.1.1 Key Pair Generation
The certification infrastructure system generates a CA key pair on a hardware security
module (hereinafter, "HSM") compliant with level 3 of FIPS140-2. The Key Pair
generation operation is jointly performed by at least two authorized individuals.
The key pair of the Subscriber is not generated in the CA facility.
6.1.2 Private Key Delivery to Subscriber
The Subscriber's private key is generated by the Subscriber themselves.
6.1.3 Public Key Delivery to Certificate Issuer
A Subscriber Public Key may be delivered online to the CA.
6.1.4 CA Public Key Delivery to Relying Parties
Relying Parties may obtain the CA Public Keys by accessing the CA Repository.
6.1.5 Key Sizes
The length of the CA Key Pair shall be 2048 bits in the RSA format. The length of a
Subscriber Key Pair shall be 2048 bits in the RSA format.
6.1.6 Public Key Parameters Generation and Quality Checking
Relevant provisions are stipulated in the CPS.
6.1.7 Key Usage Purposes"keyCertSign" and "cRLSign" bits shall be specified to the [keyUsage] of the CA
Certificate.
digitalSignature, nonRepudiation, is set in the KeyUsage of the certificate of the
Subscriber issued by the CA.
6.2 Private Key Protection and Cryptographic Module Engineering Controls

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-26

Version.1.01
341-25-A001-01
6.2.1 Cryptographic Module Standards and Controls
The generation, storage and signing operations of the CA Private Keys are performed
using an FIPS140-2 Level 3 conformant HSM.
No stipulation for Subscriber Private Keys.
6.2.2 Private Key Multi-Person Control
Activation, deactivation, backup and other operations relating to CA Private Keys arejointly performed by at least two authorized individuals in a secure environment.
No stipulation for Subscriber Private Keys.
6.2.3 Private Key Escrow
The CA does not Escrow the CA Private Keys.
The CA does not Escrow Subscriber Private Keys.
6.2.4 Private Key Backup
Backup of Private Keys of the CA is jointly performed by at least two authorizedindividuals and is stored in a secure room as encrypted.
No stipulation for Subscriber Private Keys.
6.2.5 Private Key Archive
The CA does not archive CA Private Keys.
No stipulation for Subscriber Private Keys.
6.2.6 Private Key Transfer into or from a Cryptographic Module
The transfer of Private Keys of the CA into and from an HSM is performed in a secureroom while encrypted.
No stipulation for Subscriber Private Keys.
6.2.7 Private Key Storage on Cryptographic Module
The CA's private key shall be stored in the HSM in an encrypted state.
No stipulation for Subscriber Private Keys.
6.2.8 Method of Activating Private Key
The CA Private Keys are jointly activated by at least two authorized individuals in asecure room.
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-27

Version.1.01
341-25-A001-01
No stipulation for Subscriber Private Keys.
6.2.9 Method of Deactivating Private Key
CA Private Keys are jointly deactivated by at least two authorized individuals in asecure room.
No stipulation for Subscriber Private Keys.
6.2.10 Method of Destroying Private Key
The CA Private Keys are jointly destroyed by at least two authorized individuals bymeans of complete initialization or physical destruction. The Private Key backups
are also destroyed in the same manner.
No stipulation for Subscriber Private Keys.
6.2.11 Cryptographic Module Rating
Shall be same as specified in "6.2.1 Cryptographic Module Standards and Controls"
hereof.
No stipulation for Subscriber Private Keys.
6.3 Other Aspects of Key Pair Management
6.3.1 Public Key Archival
Archives of the CA's public key and the Subscriber's public key are included in this CP“5.5.1 Types of Records Archived”.
No stipulation for Subscriber Private Keys.
6.3.2 Certificate Operational Periods and Key Pair Usage Periods
Relevant provisions are stipulated in the CPS.
6.4 Activation Data
6.4.1 Activation Data Generation and Installation
Relevant provisions are stipulated in the CPS.
6.4.2 Activation Data Protection
Relevant provisions are stipulated in the CPS.
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-28

Version.1.01
341-25-A001-01

6.4.3 Other Aspects of Activation Data
Relevant provisions are stipulated in the CPS.
6.5 Computer Security Controls
6.5.1 Specific Computer Security Technical Requirements
The CA enforce multi-factor authentication for all accounts capable of directly causing
certificate issuance.
6.5.2 Computer Security Rating
Relevant provisions are stipulated in the CPS.
6.6 Life-Cycle Security Controls
6.6.1 System Development Controls
Relevant provisions are stipulated in the CPS.
6.6.2 Security Management Controls
Relevant provisions are stipulated in the CPS.
6.6.3 Life-Cycle Security Controls
Relevant provisions are stipulated in the CPS.
6.7 Network Security Controls
Relevant provisions are stipulated in the CPS.
6.8 Time-Stamping
Relevant provisions are stipulated in the CPS.

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-29

Version.1.01
341-25-A001-01
7. Certificate, CRL, and OCSP Profiles
7.1 Certificate Profile
Certificates issued by the CA conform to RFC5280, the profile of which are indicatedin the tables below.
7.1-1 CA Certificate Profile
Basic Fields

Settings

criticalVersion （X.509 certificate version）

Version 3-

Serial Number （Certificate serial number）

32 hexadecimal digits-

Signature Algorithm

SHA-256 with RSAEncryption-

IssuerCountry

C=JP

Organization

O=SECOM Trust Systems CO.,LTD.

Organizational UnitOU=Security Communication RootCA2

NotBeforee.g.) 2022/04/08 00:00:00 GMT

Validity-（Effective start date andtime）

Subject

NotAftere.g.) 2029/05/29 05:00:39 GMT（Effective end date and

The above is the expiration date of Security

time）

Communication RootCA2Country

C=JP

Organization

O=SECOM Trust Systems CO.,LTD.

Organizational Unit

Not setCommon Name (CN)

CN= SECOM Passport Plus CA ”Number”--

G ”Number”＊"Number" value is optional

Subject RSA Public Key(2048bit)

Subject PublicKey Info

Extension Fields
Subject Key Identifier-

Settings
Subject Public Key Identifier（160-bit SHA-1 hash value of the subjectNpublic key）
Authority Key Identifier

Authority Public Key Identifier(160bit SHA-1 hash value of Authority

N

Identifier)

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-30

Version.1.01
341-25-A001-01
CRL Distribution Points

http://repository.secomtrust.net/SC-

N

Root2/SCRoot2CRL.crl
Authority Information Access

accessMethod
ocsp (1.3.6.1.5.5.7.48.1)
accessLocation
http://scrootca2.ocsp.secomtrust.net
accessMethod

N

caIssuers (1.3.6.1.5.5.7.48.2)
accessLocation
http://repository.secomtrust.net/SCRoot2/SCRoot2ca.cer
Certificate Policies

Policy: 1.2.392.200091.100.901.4

N

CPS: HTTP URL of the repository
Key Usage

keyCertSign (Signing a Certificate)Y

cRLSign (Signing a CRL)
Extended Key Usage

Microsoft Signer of documentsN=1.3.6.1.4.1.311.10.3.12
TRUE （= CA）

Basic ConstraintsY

7.1-2 Subscriber Certificate Profile
Basic Fields

Settings

criticalX.509 Version （X.509Certificate Version）

Version 3-

Serial Number （Certificate Serial Number）

32 hexadecimal digits-

Signature Algorithm

SHA-256 with RSAEncryption-

IssuerCountry

C=JP

Organization

O=SECOM Trust Systems CO.,LTD.

Common Name (CN)

CN= SECOM Passport Plus CA ”Number”-

G ”Number”*"Number" value is optional
Validity

NotBeforee.g.)2022/04/18 00:00:00 GMT（Effectiveness start date and

-

time）

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-31

Version.1.01
341-25-A001-01
e.g.)

NotAfter

2027/04/17 00:00:00 GMT（Validity end date and time）
Subject

Country

C=JP

Organization

O="Organization Name" 【Optional】

Organizational UnitOU=" Organizational Unit " 【Optional】-* Multiple OUs can be set
Common Name （Subject name）

CN="Natural Person Name or Organization
Name"

Subject PublicKey Info

Subject Public Key Data

Extension Fields（x.509 v3）
Authority Key Identifier-

Settings

criticalAuthority Public Key Identifier（160-bit SHA-1 hash value of Authority Public Key）

Subject Key Identifier

Subject Public Key Identifier（160-bit SHA-1 hash value of the Subject Public Key）

Key Usage

NN

The following can be set:
digitalSignature (Digital signature)Y

Non Repudiation (Non Repudiation)
Certificate Policies

The following can be set:
Policy: 1.2.392.200091.100.898.1
Policy: 1.2.392.200091.100.898.2

N

Policy: 1.2.392.200091.100.898.3
Policy: 1.2.392.200091.100.898.4
CPS: http://repo1.secomtrust.net/spcpp/plus/
Subject Alt Name

Not setN（Subject Alternate Name）
Extended Key Usage

Microsoft Signer of documentsN=1.3.6.1.4.1.311.10.3.12
CRL Distribution Points

HTTP URL of the CA'S CRL Service

Authority Information Access

accessMethod

N

caIssuers (1.3.6.1.5.5.7.48.2)

N

accessLocation
HTTP URL of the CA Certificate

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-32

Version.1.01
341-25-A001-01※ Items described as 【optional】 are items whose setting can be changed for eachcertificate application.
7.1.1 Version Number(s)The CA applies version 3.
7.1.2 Certificate Extension
Certificates issued by the CA use certificate extension fields.
7.1.3 Algorithm Object Identifier
The algorithm OID used in this service is as follows:
Security Communication RootCA2 algorithm OID
Algorithm

Object Identifier

sha256 With RSA Encryption

1.2.840.113549.1.1.11

RSA Encryption

1 2 840 113549 1 1 1

7.1.4 Name Format
The certificate issued by the CA meets the requirements of the X.509 standard,
RFC5280 standard, and the distinguished name assigned to the certificate holder is
set according to the X.500 distinguished name format.
7.1.5 Name Constraints
Not set.
7.1.6 Certificate Policy Object Identifier
The OID described in "1.2 Document Name and Identification" shall be applied to theobject identifier of the certificate issued by the CA.
7.1.7 Use of Policy Constraint Extensions
Not set.
7.1.8 Policy Qualifier Syntax and Semantics
For the policy qualifier, the URI of the Web page that publishes this CP and CPS isstored.
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-33

Version.1.01
341-25-A001-01

7.1.9 How to interpret Critical Certificate Policy Extensions
Not set.
7.2 CRL Profile
7.2-1 CRL Profile
Basic Fields

Settings

criticalVersion（X.509CRL Version）

Version 2-

Signature Algorithm

SHA-256 with RSAEncryption-

IssuerCountry

C=JP

Organization

O=SECOM Trust Systems CO.,LTD.

Common Name (CN)

CN= SECOM Passport Plus
CA ”Number”-

G”Number”＊"Number" value is optional
This Update（Update date and time）

e.g.)

2022/04/18 00:00:00 GMT

Next Update（Next scheduled update datee.g.)

2022/04/22 00:00:00 GMT

e.g.)

32 hexadecimal digits

Revocation Datee.g.)2022/04/17 00:00:00 GMT

Reason Code （Revocatione.g.) cessation of operation (operation

reason）

suspension)-and time）
RevokedSerial Number

Certificates（Revoked certificate serial
number）-＊ Setting is optional

Extension Fields

Settingse.g.) 1

CRL Number（Integer value indicating the order inNwhich CRLs are issued）
Authority Key Identifier

Authority Public Key Identifier (Public
Key SHA-1 hash value)N

7.2.1 Version Number(s)The CA applies CRL version 2.

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-34

Version.1.01
341-25-A001-01
7.2.2 Certificate Revocation Lists and CRL Entry Extensions
Use the CRL extension field issued by the CA.
7.3 OCSP Profile
The CA does not use OCSP.
7.3.1 Version Number(s)Not applicable.
7.3.2 OCSP Extensions
Not applicable.

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-35

Version.1.01
341-25-A001-01
8. Compliance Audit and Other Assessments
8.1 Frequency and Circumstances of Assessment
The CA performs compliance audits at least once a year to examine if the operation of
the services is in compliance with this CP and the CPS. The matters related tocompliant audits conducted by the CA shall be stipulated in the CPS.
8.2 Identity/Qualifications of Assessor
Relevant provisions are stipulated in the CPS.
8.3 Assessor’s Relationship to Assessed Entity
Relevant provisions are stipulated in the CPS.
8.4 Topics Covered by Assessment
Relevant provisions are stipulated in the CPS.
8.5 Actions Taken as a Result of Deficiency
Relevant provisions are stipulated in the CPS.
8.6 Communication of Results
Relevant provisions are stipulated in the CPS.

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-36

Version.1.01
341-25-A001-01
9. Other Business and Legal Matters
9.1 Fees
9.1.1 Fees for Issuing or Renewing Certificates
Stipulated separately in contracts.
9.1.2 Certificate Access Fee
No stipulation.
9.1.3 Expiration or Access Fee for Status Information
No stipulation.
9.1.4 Fees for Other Services
No stipulation.
9.1.5 Refund Policy
Stipulated separately in contracts.
9.2 Financial Responsibility
9.2.1 Insurance Coverage
SECOM Trust Systems shall maintain a sufficient financial base for the operation andmaintenance of the CA.
9.2.2 Other Assets
No stipulation.
9.2.3 End entity Insurance or Warranty coverage
No stipulation.
9.3 Confidentiality of Business Information
9.3.1 Scope of Confidential Information
Relevant provisions are stipulated in the CPS.
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-37

Version.1.01
341-25-A001-01

9.3.2 Information Not Within the Scope of Confidential Information
Relevant provisions are stipulated in the CPS.
9.3.3 Responsibility to Protect Confidential Information
Relevant provisions are stipulated in the CPS.
9.4 Privacy of Personal Information
9.4.1 Personal Information Protection Plan
Relevant provisions are stipulated in the CPS.
9.4.2 Information Treated as Personal Information
Relevant provisions are stipulated in the CPS.
9.4.3 Information that is not considered Personal Information
Relevant provisions are stipulated in the CPS.
9.4.4 Responsibility for protecting Personal Information
Relevant provisions are stipulated in the CPS.
9.4.5 Notice and Consent regarding use of Personal Information
Relevant provisions are stipulated in the CPS.
9.4.6 Disclosure of Information in accordance with Judicial or Administrative
Procedures
Relevant provisions are stipulated in the CPS.
9.4.7 Other Information Disclosure Conditions
Relevant provisions are stipulated in the CPS.
9.5 Intellectual Property Rights
The following copyrighted materials are the property of SECOM Trust Systems.
・ This CP
・ CPS： Property of SECOM Trust Systems (including copyright)： Property of SECOM Trust Systems (including copyright)

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-38

Version.1.01
341-25-A001-01
・ CRL： Property of SECOM Trust Systems

This CP, may be reproduced provided that the original document is properly referenced.
It is published under the Creative Commons license Attribution-NoDerivatives (CC-BYND) 4.0.

https://creativecommons.org/licenses/by-nd/4.0/
9.6 Representations and Warranties
9.6.1 CA Representation and Warranties
SECOM Trust Systems bears the obligation to perform the following in the executionof its duties as a CA:
・ Secure generation and management of CA Private Keys;
・ Accurate issuance, revocation and management of certificates based on LRA andapplicant's application;
・ Management and operational monitoring of the systems;
・ Issuance and publication of CRLs;
・ Maintenance and administration of the Repository.
9.6.2 RA Representations and Warranties
SECOM Trust Systems bears the obligation to perform the following in the executionof its duties as an RA:
・ Installation and operation of registration terminals in a secure environment;
・ Appropriate examination such as confirmation of the existence of the applicationfrom the LRA and corporations and organizations.
And LRA bears the obligation to perform the following in the execution of its duties as
LRA:・ Installation and operation of registration terminals in a secure environment;
・ Appropriate examination such as confirmation of the existence of the applicationfrom the Applicants and Subscribers.
・ Accurate and prompt application for certificate issuance/revocation to the CA

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-39

Version.1.01
341-25-A001-01

9.6.3 Applicant and Subscriber Representations and Warranties
Applicants and Subscribers shall bear obligations to the following:
・ Provide accurate and complete information to the CA or LRA when applying for acertificate;・ Promptly notify the CA or LRA of any change in the information provided therein;
・ Protect their own Private Keys against compromise;・ Use the Certificates conforming to the provisions of this CP and CPS; and・ Promptly request the CA or LRA to revoke the Subscriber Certificate in case theSubscriber determines that the Private Key corresponding to the Public Key
indicated therein has or may have been compromised, or there has been a change
in the registered information, or if the CA instructs to revoke a certificate based on“4.9.1 Reason for Certificate Revocation”.
9.6.4 Relying Party Representations and Warranties
Relying Parties shall bear the obligations to the following:・ Authenticate the validity of the CA Certificate;・ Authenticate the validity of the Subscriber Certificate by checking the validity
period thereof to ensure that it has not expired and that it is not registered as a
revoked Certificate in the CRL or; and・ Determine whether or not to trust the Subscriber information on their own
responsibilities.
9.6.5 Representations and Warranties of Other Participants
No stipulation.
9.7 Disclaimer of Warranties
SECOM Trust Systems is not liable for any direct, special, incidental or consequential
damages arising in connection with the warranties stipulated in "9.6.1CA
Representations and Warranties" and "9.6.2 RA Representations and Warranties"
hereof, or for lost earnings, loss of data, or any other indirect or consequential damages.
9.8 Limitations of Liability
SECOM Trust Systems is not liable for the provisions of "9.6.1 CA Representationsand Warranties" and "9.6.2 RA Representations and Warranties" hereof in any of theSecom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-40

Version.1.01
341-25-A001-01
following cases:
・ Any damage arising from unlawful conduct, unauthorized use, negligence or any
other cause not attributable to SECOM Trust Systems;
・ Any damage attributable to the failure of a Subscriber to perform its obligations;・ Any damage attributable to LRA or a Subscriber system;
・ Damages attributable to a hardware or software defect or malfunction or any otherbehavior of LRA or the Subscriber system;
・ Damages caused by information published in a Certificate, a CRL or on the due tothe reasons not attributable to SECOM Trust Systems;
・ Any damage incurred in an outage of the normal communication due to reasons
not attributable to SECOM Trust Systems;
・ Any damage arising in connection with the use of a Certificate, includingtransaction debts;
・ Damages attributable to improvement, beyond expectations at this point in time,in hardware or software type of cryptographic algorithm decoding skills; and・ Any damage attributable to the suspension of the CA's operations due to force
majeure, including, but not limited to, natural disasters, earthquakes, volcanic
eruptions, fires, tsunami, floods, lightning strikes, wars, civil commotion andterrorism.
9.9 Indemnities
Indemnities for certificates issued by the CA will be stipulated separately.
9.10 Term and Termination
9.10.1 Term
This CP goes into effect upon approval by the Certification Services Improvement
Committee.
This CP will not be invalidated under any circumstances prior to the termination
stipulated in "9.10.2 Termination" hereof.
9.10.2 Termination
This CP loses effect as of the termination for SECOM Passport Plus by SECOM Trust
Systems with the exception of the provisions stipulated in "9.10.3 Effect of Terminationand Survival".
Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-41

Version.1.01
341-25-A001-01

9.10.3 Effect of Termination and Survival
When the Subscriber terminates the use of the certificate, the contract between
SECOM Trust Systems and the contractor is terminated, and even if the services
provided by SECOM Trust Systems are terminated, the provisions that should bemaintained due to the nature, shall apply to the Subscriber, the Relaying Party, thecontractor of SECOM Trust Systems, and SECOM Trust Systems regardless of thereason.
9.11 Individual Notices and Communications with Participants
SECOM Trust Systems provides the necessary notices to LRA, Subscribers andRelying Parties through its website, e-mail or in other written forms.
9.12 Amendments
9.12.1 Procedure for Amendment
This CP shall be revised by SECOM Trust Systems as appropriate at its discretion,and goes into effect upon approval by its Certification Services Improvement
Committee.
9.12.2 Notification Method and Timing
Whenever this CP is modified, the prompt publication of the modified CP shall bedeemed as the notification thereof to the participants.
9.12.3 Circumstances under Which OID Must Be Changed
Change the OID if the Certification Service Improvement Committee determines that
it is necessary.
9.13 Dispute Resolution Procedures
A party seeking to file a lawsuit, request arbitration or take any other legal action
against SECOM Trust Systems for the resolution of a dispute relating to a Certificate
issued by the CA, said party shall notify SECOM Trust Systems to this effect inadvance. As regards the location for arbitration and court proceedings, a disputesettlement institution located within Tokyo shall have exclusive jurisdiction.

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-42

Version.1.01
341-25-A001-01
9.14 Governing Law
The laws of Japan will apply to any dispute concerning the interpretation or validityof this CP and the CPS, as well as the use of the Certificates.
9.15 Compliance with Applicable Law
The CA shall handle cryptographic hardware and software in compliance with relevant
export regulations of Japan.
9.16 Miscellaneous Provisions
9.16.1 Entire Agreement
SECOM Trust Systems comprehensively stipulates the obligations of Subscribers andRelying Parties and other relevant matters in this CP and the CPS, for provision of
the services. Any agreement otherwise, whether oral or written, shall have no effect.
9.16.2 Assignment
When assigning the services to a third party, Secom Trust Systems may assign its
responsibilities and other obligations specified in this CP and the CPS.
9.16.3 Severability
Even if any provision of this CP or the CPS is deemed invalid, all other provisions
stipulated therein shall remain in full force and effect.
9.16.4 Enforcement
Disputes regarding this service shall be governed by the Tokyo District Court, andSecom Trust Systems may seek compensation and attorney's fees from the parties forany dispute arising from the contractual provisions of each prescribed document,
damages, losses and costs related to the parties' actions.
9.16.5Irresistible Force

Secom Trust Systems shall not be liable for any damages caused by natural disasters,
earthquakes, eruptions, fires, tsunamis, floods, lightning strikes, disturbances,terrorism, or any other force majeure, whether or not foreseeable. If it becomes
impossible to provide the CA, we may suspend the CA until the situation ceases.

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-43

Version.1.01
341-25-A001-01
9.17 Other Provisions
No stipulation

Secom Passport Plus
Certificate Policy© 2022 SECOM Trust Systems CO., LTD.
P-44