# Security Communication ECC RootCA1 root certificate (SECOM Trust Systems)

> Security Communication ECC RootCA1 is a root CA certificate operated by SECOM Trust Systems (ECDSA P-384, valid until 2038-01-18, SHA-256 E74FBDA5). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Mozilla, Microsoft.

Source: https://ssl.sh/roots/secom-security-communication-ecc-rootca1/
Last updated: 2026-11-10

Security Communication ECC RootCA1 is a root CA certificate operated by SECOM Trust Systems (ECDSA P-384, valid until 2038-01-18, SHA-256 E74FBDA5). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Chrome, Mozilla, Microsoft.

| Field | Value |
|---|---|
| CA owner | SECOM Trust Systems |
| Subject | CN=Security Communication ECC RootCA1,O=SECOM Trust Systems CO.\,LTD.,C=JP |
| SHA-256 | E74FBDA55BD564C473A36B441AA799C8A68E077440E8288B9FA1E50E4BBACA11 |
| SPKI SHA-256 | 3329BFA13B6007AB5FC3713F0ACB289426E2FBC99CC5C110A914B139571600B6 |
| Valid from | 2016-06-16 |
| Expires | 2038-01-18 |
| Key | ECDSA P-384 |
| Signature algorithm | ecdsa-with-SHA384 |
| Serial number | D65D9BB378812EEB |
| SHA-1 (Windows thumbprint) | B80E26A9BFD2B23BC0EF46C9BAC7BBF61D0D4141 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: not EV-enabled; First included in: NSS 3.83 / Firefox 106; Inclusion bug: #1313982 |
| Apple | Not included | No | - | - |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Document Signing, Encrypting File System, Secure Email, Time Stamping; Not-before cutoff: 2025-09-15 (Code Signing, Document Signing, Secure Email, Time Stamping) |

The CCADB lists no EV policy OID for Security Communication ECC RootCA1.

## Intermediate CAs issued by this root

The CCADB lists 11 intermediate CA certificates signed directly by Security Communication ECC RootCA1: 4 currently valid, 1 expired and 6 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| SECOM TLS ECC Root CA 2024 | SECOM Trust Systems Co., Ltd. | 2038-01-18 | Valid | 22DA96F19EFC0429034A22755E9D7FE4746B3CAD56A013ED1C02F142A722B9A7 |
| JPRS OV ECC CA 2024 G1 | Japan Registry Services Co., Ltd. | 2031-06-16 | Valid | 9C280369D072F89D9C9B62640BBF2F28D2F30ECEE9759854031D5C5C53E8D1B6 |
| JPRS DV ECC CA 2024 G1 | Japan Registry Services Co., Ltd. | 2031-06-16 | Valid | 1B901D550A5A51F6737279C6021445F051BD293015612A5BAA3F8588829EE69A |
| NII Open Domain CA - G7 ECC | SECOM Trust Systems CO., LTD. | 2030-12-15 | Valid | 81CD03067252FFE849B240DCC24566678677E3F5FEDC4C540D7A26CAD2C081C8 |
| Subordinate Advanced ECC CA1_2016-2019 | SECOM Trust Systems CO., LTD. | 2019-12-15 | Expired | CD42341E085A9B3C2E82DF68850107B6ED2C14F6AA50C69CFC318AC3B88240A7 |
| Subordinate Advanced ECC CA G2 | SECOM Trust Systems Co., Ltd. | 2038-01-18 | Revoked | 6CCF52765B3B35B476030F16ECE24279DC87FC10CC784BC0E04919E904D25407 |
| Subordinate Advanced ECC CA G2_2020-2030 | SECOM Trust Systems Co., Ltd. | 2030-10-07 | Revoked | BDBF06CE9E56C4507FC24ED7FE1FBEBAA9B6C83A5C6D7C22C39911D9F5125E5A |
| NII Open Domain CA - G6 | SECOM Trust Systems CO., LTD. | 2030-05-20 | Revoked | 9C669F3AC59B738A5FF6BC70A5D9FD277C3D9E420F31DE234F7149D84E2EF19F |
| NII Open Domain CA - G6 | SECOM Trust Systems CO., LTD. | 2030-03-23 | Revoked | AE59CD71C4DEE107DC3B54B144CA0630B60CCF01A1461AB6D2AD0AC41FA33826 |
| NII Open Domain CA - G6 | SECOM Trust Systems CO., LTD. | 2029-03-14 | Revoked | 012BB72AAA11068FC84E276CA1D41E0D67D546B204F53C417EAF471047F67460 |
| NII Open Domain CA - G6 | SECOM Trust Systems CO., LTD. | 2028-03-22 | Revoked | 76BD451EBB1A86332C608D9993878610831855717D7B9D6B82B3CDE7276E6B75 |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as Security Communication ECC RootCA1 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Security Communication ECC RootCA1, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Security Communication RootCA2 | SECOM Trust Systems Co., Ltd. | 2029-05-29 | Valid | C3EBCEA7E6B13AC3EB3A79F05819E67D6893C65642F50D9B5E1647CB26506B8E |

## What happens when it expires

Security Communication ECC RootCA1 is valid until 2038-01-18, about 11.2 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Security Communication ECC RootCA1 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Chrome, Mozilla, Microsoft trust it for TLS server authentication; Apple do not.

**When does Security Communication ECC RootCA1 expire?**

On 2038-01-18, about 11.2 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Security Communication ECC RootCA1 issued?**

The CCADB lists 11: 4 valid, 1 expired and 6 revoked. The newest valid one is SECOM TLS ECC Root CA 2024, valid until 2038-01-18.

**Is Security Communication ECC RootCA1 cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by Security Communication RootCA2; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).