1933127 - SECOM: New Subordinate CA Request(Cybertrust Japan SureServer CA G5)

Status: RESOLVED DUPLICATE of bug 1933132

(CA Program :: CA Certificate Root Program, enhancement)

Comment 1

[SECOM Trust Systems - ONO Fumiaki]

Attachment: 04_Cybertrust_Japan_SureMail_CA_G5_Sub-CA-Profile.xlsx

Comment 2

[SECOM Trust Systems - ONO Fumiaki]

Attachment: 05_Audit_Report_01.zip

Comment 3

[SECOM Trust Systems - ONO Fumiaki]

Attachment: 05_Audit_Report_02.zip

Comment 4

[SECOM Trust Systems - ONO Fumiaki]

Attachment: 07_CCADB Self Assessment Framework (v1.4)_CTJ_20240904.xlsx

Comment 5

[SECOM Trust Systems - ONO Fumiaki]

Externally Operated Subordinate CAs

We apply under the application procedure for "Externally Operated Subordinate CAs".
https://wiki.mozilla.org/CA/External_Sub_CAs

1. Full Legal Name

Cybertrust Japan Co., Ltd.

2. Website URL

https://www.cybertrust.co.jp/

3. Expected CA hierarchy under the subordinate CA

• Root CA
  Security Communication RootCA2
  https://crt.sh/?caid=1160

• Current Subordinate CAs
  Cybertrust Japan SureMail CA G4
  https://crt.sh/?caid=141944
  Cybertrust Japan SureServer CA G4
  https://crt.sh/?caid=141642
  Cybertrust Japan SureServer EV CA G3
  https://crt.sh/?caid=141632

• New subordinate CA established on 2024-11-14
  Cybertrust Japan SureServer CA G5

4. Certificate profile for the subordinate CA certificate

https://bugzilla.mozilla.org/attachment.cgi?id=9439621

5. CP, CPS, or CP/CPS for the operation of the subordinate CA

Repository
https://www.cybertrust.ne.jp/ssl/repository/
CP
https://www.cybertrust.ne.jp/ssl/repository/SMCP_English.pdf
CPS
https://www.cybertrust.ne.jp/ssl/repository/CTJCPS_English.pdf

6. Audit statements, auditor information and qualifications

https://bugzilla.mozilla.org/attachment.cgi?id=9439622
https://bugzilla.mozilla.org/attachment.cgi?id=9439623

7. The subordinate CA’s Compliance Self-Assessment

https://bugzilla.mozilla.org/attachment.cgi?id=9439624

8. The results of the root CA operator’s detailed policy and audit review for the subordinate CA

• We have reviewed and confirmed the policy documentation and audit records of CyberTrust.

9. Explanation about why this subordinate CA is needed, e.g. Value Justification. For example, the primary reason in the explanation can be that:

In accordance with Mozilla’s policy on Externally-Operated Subordinate CAs, SECOM Trust Systems (hereinafter referred to as “SECOM”) is requesting a review and approval process for Cybertrust Japan (hereinafter referred to as “Cybertrust”). SECOM will issue a new Subordinate CA certificate to Cybertrust. The Subordinate CA certificate is planned to be issued from "Security Communication RootCA2," owned by SECOM, and its profile will be S/MIME Strict Generation.

Cybertrust is a company listed on the Tokyo Stock Exchange (Corporate Website: https://www.cybertrust.co.jp/ ). With extensive experience in CA operations, Cybertrust has contributed to enhancing the safety and reliability of internet and email security primarily in Japan for over 20 years. During this time, Cybertrust has been providing authentication and security services as a commercial CA by issuing public certificates within the nation.

Since 2019, Cybertrust has been providing TLS and S/MIME (Legacy Generation) certificates as an Externally-Operated Subordinate CA of SECOM. SECOM intends to continue its close collaboration with Cybertrust and maintain the Externally-Operated Subordinate CA going forward.

As mentioned earlier, Cybertrust is currently operating the S/MIME Legacy Generation Subordinate CA. However, to transition to the Strict Generation, a new Subordinate CA certificate needs to be issued.

Lastly, SECOM has previously reported two Mozilla incidents related to Cybertrust. In both cases, SECOM and Cybertrust worked together promptly to investigate and address the issues, taking swift action, and successfully closing all incidents.

• SECOM: One of the EV certificate was mis-issued with the incorrect Registration Number by Cybertrust Japan (CTJ) 　
  https://bugzilla.mozilla.org/show_bug.cgi?id=1805866

• SECOM: Failed an annual CPS update of Cybertrust Japan (CTJ) 　
  https://bugzilla.mozilla.org/show_bug.cgi?id=1769222

SECOM will continue its close collaboration with Cybertrust, ensuring on going compliance at all times.