# SECOM TLS RSA Root CA 2024 root certificate (SECOM Trust Systems)

> SECOM TLS RSA Root CA 2024 is a root CA certificate operated by SECOM Trust Systems (RSA 4096, valid until 2049-01-14, SHA-256 1435F225). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Mozilla, Apple, Microsoft.

Source: https://ssl.sh/roots/secom-tls-rsa-root-ca-2024/
Last updated: 2026-11-10

SECOM TLS RSA Root CA 2024 is a root CA certificate operated by SECOM Trust Systems (RSA 4096, valid until 2049-01-14, SHA-256 1435F225). As of the latest CCADB data it is trusted for TLS server authentication by 3 of 4 major root stores: Mozilla, Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | SECOM Trust Systems |
| Subject | CN=SECOM TLS RSA Root CA 2024,O=SECOM Trust Systems Co.\, Ltd.,C=JP |
| SHA-256 | 1435F225C5D252D7A21948CC3CE62AECFA88001E3DD72D1CC3555100EB372F93 |
| SPKI SHA-256 | F0E0B6FBE8B74D4F82D8ED8F8BD6A3D083DC19DB3D2CEDB1061CCB76D848EE7D |
| Valid from | 2024-01-31 |
| Expires | 2049-01-14 |
| Key | RSA 4096 |
| Signature algorithm | sha384WithRSAEncryption |
| Serial number | EE8934D0CB80E0B2 |
| SHA-1 (Windows thumbprint) | FB97967CEF8D986306C03BB611F8E01397A298D3 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Not included | No | - | - |
| Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: 2.23.140.1.1; First included in: 3.126 / 154; Inclusion bug: #1943001 |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication |

Mozilla treats it as an EV root for policy OID 2.23.140.1.1.

## Intermediate CAs issued by this root

The CCADB lists 7 intermediate CA certificates signed directly by SECOM TLS RSA Root CA 2024: 5 currently valid, 0 expired and 2 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| NII Open Domain CA - G8 RSA | SECOM Trust Systems Co., Ltd. | 2040-08-21 | Valid | 7A4AD9E1BA2DFB08F752A124032F7058868062E9841785623EB4136783A53FFC |
| SECOM Passport for Web EV RSA CA 2024 | SECOM Trust Systems Co., Ltd. | 2039-01-12 | Valid | 3E2464D4562FB4410F20C5C66C812C52BFBBEF31059CE55EF5BDB3703386AA74 |
| SECOM Passport for Web OV RSA CA 2024 | SECOM Trust Systems Co., Ltd. | 2039-01-12 | Valid | 3520ABFC5A4C2558C89BF90EE29181D19518CCA6D0A57A6DC568F4F07C89F8DD |
| JPRS OV RSA CA 2024 G1 | Japan Registry Services Co., Ltd. | 2039-01-12 | Valid | DAFA254E0173F0FD793A92ECFDF2C72C53EA5A761A73B7A3394C49182EA90933 |
| JPRS DV RSA CA 2024 G1 | Japan Registry Services Co., Ltd. | 2039-01-12 | Valid | 52361A6ABC835E7AD4B375F2165055303169DDE9FBEB4FAAF588ED532DDC2DCB |
| Cybertrust iTrust EV TLS RSA4096 CA 2025 E1 | Cybertrust Japan Co., Ltd. | 2029-07-31 | Revoked | DCD585E03684BA69ABFA3B38E8516E430B74825FFAEE37B9625907907B690DA2 |
| Cybertrust iTrust OV TLS RSA4096 CA 2025 E1 | Cybertrust Japan Co., Ltd. | 2029-07-31 | Revoked | A308AB06E697508B68777C35E1F6B6C573E3200A0E6ABE621781F5AF9CF04862 |

## Cross-signed versions

1 certificate(s) in the CCADB have the same subject and public key as SECOM TLS RSA Root CA 2024 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not SECOM TLS RSA Root CA 2024, can still build a chain.

| Signed by | CA owner | Expires | Status | SHA-256 |
|---|---|---|---|---|
| Security Communication RootCA2 | SECOM Trust Systems Co., Ltd. | 2029-05-29 | Valid | C8FB5BB81193CA9B531E2A0A568F14CC75D20924B98D2724DD243F63D813CF13 |

## What happens when it expires

SECOM TLS RSA Root CA 2024 is valid until 2049-01-14, about 22.2 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is SECOM TLS RSA Root CA 2024 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Mozilla, Apple, Microsoft trust it for TLS server authentication; Chrome do not.

**When does SECOM TLS RSA Root CA 2024 expire?**

On 2049-01-14, about 22.2 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has SECOM TLS RSA Root CA 2024 issued?**

The CCADB lists 7: 5 valid, 0 expired and 2 revoked. The newest valid one is NII Open Domain CA - G8 RSA, valid until 2040-08-21.

**Is SECOM TLS RSA Root CA 2024 cross-signed?**

Yes. The CCADB has 1 cross-certificate(s) with its subject and key, signed by Security Communication RootCA2; 1 of them are still valid.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).