# Security Communication RootCA2 root certificate (SECOM Trust Systems)

> Security Communication RootCA2 is a root CA certificate operated by SECOM Trust Systems (RSA 2048, valid until 2029-05-29, SHA-256 513B2CEC). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/secom-security-communication-rootca2/
Last updated: 2026-11-10

Security Communication RootCA2 is a root CA certificate operated by SECOM Trust Systems (RSA 2048, valid until 2029-05-29, SHA-256 513B2CEC). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | SECOM Trust Systems |
| Subject | OU=Security Communication RootCA2,O=SECOM Trust Systems CO.\,LTD.,C=JP |
| SHA-256 | 513B2CECB810D4CDE5DD85391ADFC6C2DD60D87BB736D2B521484AA47A0EBEF6 |
| SPKI SHA-256 | 3380709AF3B096BE3CC2A40548142C0A520028DB09E2CB77AE2206616AB6CBB4 |
| Valid from | 2009-05-29 |
| Expires | 2029-05-29 |
| Key | RSA 2048 |
| Signature algorithm | sha256WithRSAEncryption |
| Serial number | 0 |
| SHA-1 (Windows thumbprint) | 5F3B8CF2F810B37D78B4CEEC1919C37334B9C774 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Included | Yes | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites, Email; EV policy OIDs: 1.2.392.200091.100.721.1; First included in: NSS 3.13.2 / Firefox 11; Inclusion bug: #1096205 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Secure Email, Time Stamping; Not-before cutoff: 2026-09-15 (Code Signing) |

Mozilla treats it as an EV root for policy OID 1.2.392.200091.100.721.1.

## Intermediate CAs issued by this root

The CCADB lists 104 intermediate CA certificates signed directly by Security Communication RootCA2: 23 currently valid, 6 expired and 75 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| SECOM Passport for Member PUB CA5 | SECOM Trust Systems Co., Ltd. | 2029-05-29 | Valid | 856E6CF4F7F8D60BA7008D4A254CBB4FABB917CF9BCBB646C16116B36D9220F8 |
| SECOM Passport for Member PUB CA8 | SECOM Trust Systems Co., Ltd. | 2028-01-09 | Valid | 477D78D6E868E77A269204640DF25669E189B27C6CFB70E463BD434551E6BDC1 |
| SECOM Passport for Member PUB CA4 | SECOM Trust Systems Co., Ltd. | 2028-10-04 | Valid | 16BB40109C9F040BBAC91401CFA67FB1B69CD2B4889CB0CD749B3DAE2B399797 |
| SECOM SMIME RSA Root CA 2024 | SECOM Trust Systems Co., Ltd. | 2029-05-29 | Valid | F40B41A46A5646A45F51AE0DE2B7263E4F3B6EBAC795B539DB3811F4B4333A79 |
| SECOM TLS RSA Root CA 2024 | SECOM Trust Systems Co., Ltd. | 2029-05-29 | Valid | C8FB5BB81193CA9B531E2A0A568F14CC75D20924B98D2724DD243F63D813CF13 |
| SECOM Passport for Web SR 3.0 CA | SECOM Trust Systems Co., Ltd. | 2028-03-16 | Valid | 59F8A94C11BCD19FD4E0F1AC4D394E37913AE5FB5862A25A8ECD167BA3B9A3A2 |
| Cybertrust Japan SureMail CA G5 | Cybertrust Japan Co., Ltd. | 2029-05-29 | Valid | 995C3C64F32348142BF1EBEAF7370781A1C30682DE02AD85FB2700CE1395F737 |
| Security Communication ECC RootCA1 | SECOM Trust Systems Co., Ltd. | 2029-05-29 | Valid | C3EBCEA7E6B13AC3EB3A79F05819E67D6893C65642F50D9B5E1647CB26506B8E |
| Cybertrust Japan SureServer EV CA G3 | Cybertrust Japan Co., Ltd. | 2029-05-29 | Valid | B723273A3506C6BED85F083DA562734BE09F2C47ADE47317831D63AA8BE278A5 |
| Cybertrust Japan SureServer CA G4 | Cybertrust Japan Co., Ltd. | 2029-05-29 | Valid | 8346922CB8730BB6AE71AB03BFC42462F4160423D9079BE64385621AC5877672 |
| SECOM Passport for Web EV 2.0 CA | SECOM Trust Systems CO., LTD. | 2029-05-29 | Valid | 39B6E3B388F749521DF2B354182EB4CD87D4BF36439BFAF0202E5596CFC2CAA4 |
| Cybertrust Japan SureMail CA G4 | Cybertrust Japan Co., Ltd. | 2029-05-29 | Valid | BEA27C18D65948D8C61D582447B3747774609391A7E961CFA82331070BA6E77E |
| SECOM Passport for PublicID SMIME RSA CA 2023 | SECOM Trust Systems CO., LTD. | 2029-05-29 | Valid | DB088F140ACBE85FA1EC83D3851063803FFD8471564CF852B92A60FEB965A02F |
| SECOM Passport Plus CA1 G1 | SECOM Trust Systems CO., LTD. | 2029-05-29 | Valid | C798C9CD2324778FE3B20657B0A267D44EAAD6987FFB60A284A7A7C9B3CAAE0F |
| SECOM Passport for Member PUB CA7 | SECOM Trust Systems CO., LTD. | 2029-05-29 | Valid | BA08827159A8510FDF274383DCC44E70423416DF862B972F8945AAF49E30D5A4 |
| SECOM TimeStamping CA2 | SECOM Trust Systems CO., LTD. | 2029-05-29 | Valid | 2AF80BCD3A5A53406FF22271DB84B938417E8C338E5AA28CC47575FD41F22615 |
| FUJIFILM Fnet CA - C | FUJIFILM | 2029-05-29 | Valid | 8A3F5C460B6FF81C7AAE21A9081BB0609AB957AA1150521EEE68BD38B894BB65 |
| NII Open Domain CA - G7 RSA | SECOM Trust Systems CO., LTD. | 2029-05-29 | Valid | 603DB707A584003BED6F1D43DCD4EAE13CD18D798E827DE2F3A31F3193FC0DAC |
| JPRS Domain Validation Authority - G4 | Japan Registry Services Co., Ltd. | 2029-05-29 | Valid | F19D55CD08A3EA42BD91508073823174DD92370213C177F82531756DA7508A51 |
| JPRS Organization Validation Authority - G4 | Japan Registry Services Co., Ltd. | 2029-05-29 | Valid | 801C522D3AD138E4F05D467EA369C1CC276078BF284018D0525EBBBC5342C836 |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as Security Communication RootCA2 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Security Communication RootCA2, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Security Communication RootCA1 | SECOM Trust Systems CO., LTD. | 2023-09-29 | Revoked | C415CEBFA3FC2EF3C74092B84265BAD64C3FC9994C91177965667D7ABEE90588 |

## What happens when it expires

Security Communication RootCA2 is valid until 2029-05-29, about 2.5 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is Security Communication RootCA2 trusted by Chrome, Firefox, Safari and Windows?**

Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication.

**When does Security Communication RootCA2 expire?**

On 2029-05-29, about 2.5 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has Security Communication RootCA2 issued?**

The CCADB lists 104: 23 valid, 6 expired and 75 revoked. The newest valid one is SECOM Passport for Member PUB CA5, valid until 2029-05-29.

**Is Security Communication RootCA2 cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by Security Communication RootCA1; 0 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).