TrustAsia Certificate Policy and Certification Practice Statement for Mark Certificate Service (CP&CPS)

TrustAsia Technologies, Inc. (Chinese abbreviation: "亚洲诚信", English abbreviation: "TrustAsia") was established in April 2013. In December 2020, TrustAsia CA passed the qualification review organized by the State Cryptography Administration (SCA) and was granted the "Electronic Authentication Service Cryptography License" issued by SCA (License number: 0060). In November 2021, TrustAsia CA obtained the "Electronic Certification Service License" issued by the Ministry of Industry and Information Technology of China (License number: ECP31010421056).

TrustAsia CA was granted "ISO9001 Quality Management System Certification", "ISO 27001 Information Security Management System Certification", and "ISO22301 Business Continuity Management System Certification" by China Quality Certification Centre (CQC), all of which were accredited by China National Accreditation Service for Conformity Assessment (CNAS) and the International Accreditation Forum (IAF).

TrustAsia CA is an outstanding domestic cybersecurity digital certificate and security monitoring solution provider. Its brand, TrustAsia, specializes in providing internationally renowned digital certificates and cybersecurity management solutions, and is recognized and trusted in the field of cybersecurity.

With internationally standardized operational management and service capabilities, TrustAsia CA provides globalized electronic authentication services for users with requirements on communication and information security in a variety of industries.

This document describes the integrated technology, protocols, and identity and trademark verification standards implemented by TrustAsia CA for issuing consumer-trusted Mark Certificates. This CP&CPS covers the following four types of Mark Certificates:

Common Mark Certificates (CMC):

a. Prior Use Mark Certificates

b. Modified Registered Mark Certificates

Verified Mark Certificates (VMC):

a. Registered Mark Certificates

b. Government Mark Certificates

TrustAsia CA issues certificates based on different use cases and algorithms. Please refer to the repository at https://repository.trustasia.com for details.

This CP&CPS is compiled in accordance with the "Measures for the Administration of Electronic Certification Services" and the "Rules for Electronic Authentication Business (for Trial Implementation)" issued by the Ministry of Industry and Information Technology of the People’s Republic of China.

This CP&CPS describes how TrustAsia CA carries out electronic certification business, including the business methods and processes of applying for, approving, issuing, managing, revoking and updating certificates, as well as the corresponding service, legal and technical measures and safeguards, for electronic certification participants to understand and follow.

The contents described in this CP&CPS follow the following policies, guidelines and requirements:

TrustAsia CA will periodically review its updates and will continue to revise the CP&CPS. If there is any inconsistency between this CP&CPS and the above relevant standards, the above officially published specifications shall prevail.

TrustAsia CA issues Mark Certificates in accordance with MCR requirements, and includes the MC policy OID in the Certificate Policies Extension. For details, see Section 7.1.6 of this CP&CPS.

The following are some of the object identifiers used in this CP&CPS:

TrustAsia CA operates simultaneously as a Certification Authority (CA) and a Mark Verifying Authority (MVA).

TrustAsia CA is a legally established electronic certification service organization. It participates in electronic certification activities by issuing digital certificates to parties engaged in electronic transactions and providing digital certificate verification services.

As an operator of multiple CAs, TrustAsia CA executes functions related to public key operations, including receiving certificate requests, issuing, revoking and updating digital certificates, and maintaining, issuing and publishing CRLs and OCSP responses. For information about TrustAsia CA’s products and services, please visit www.trustasia.com.

On behalf of the CA, the Registration Authority (RA) establishes the certificate registration process, confirms the identity of the certificate applicant (Subscriber), approves or rejects certificate applications, approves Subscriber certificate revocation requests or directly revokes certificates, and approves Subscriber certificate renewal requests.

In addition to assuming the role of CA, TrustAsia CA will act as its own RA and will not establish a separate RA.

Subscribers are all end-users who obtain certificates from TrustAsia CA, also referred to as Mark Asserting Entities.

Relying Parties are any natural or legal persons who rely on the Mark Certificates issued by TrustAsia CA, or who rely on the information or marks contained in the Mark Certificates, or who rely on the information or marks presented to them by a Consuming Entity.

Other participants refer to other entities that provide related services for TrustAsia CA’s electronic certification activities, including the CPA Canada WebTrust Working Group.

Certificates issued pursuant to this CP&CPS are intended to enable efficient and secure electronic communication, while addressing user concerns about certificate trustworthiness, and helping users make informed decisions when relying on certificates.

Digital certificates issued by TrustAsia CA are functionally limited and may only be used for purposes appropriate to the identity represented by the certificate. Uses of certificates that exceed the scope defined in this CP&CPS will not be protected by this CP&CPS.

Certificates issued by TrustAsia CA are prohibited from use in any circumstances that violate national laws, regulations or undermine national security, from use in man-in-the-middle (MITM) attacks, and from use in any criminal activity or related business prohibited by law. Otherwise, the Subscriber shall bear all legal consequences arising therefrom.

The governing body of this CP&CPS is the TrustAsia CA Security Policy Committee, which is responsible for formulating, approving, issuing, implementing, updating and revoking this CP&CPS. The Security Policy Committee is composed of appropriate representatives from the company’s management responsible for operational security, technical security, customer service and human resources security.

The daily work of external consulting services for this policy document is handled by the Policy Department.

The TrustAsia CA Security Policy Committee is the primary body for policy formulation and the highest authority for reviewing and approving this CP&CPS.

This CP&CPS is compiled by a CP&CPS drafting team organized by the TrustAsia CA Security Policy Committee. Upon completion, it is submitted to the Security Policy Committee for review and, upon approval, is officially published on the TrustAsia CA official website.

This CP&CPS is revised in accordance with national policies and regulations, technical requirements, business developments, and the MCR requirements published by the BIMI Group. The CP&CPS drafting team prepares the revision content and submits it to the Security Policy Committee for review. Upon approval, the version number is incremented, the release/effective date and revision history are updated, and the CP&CPS is officially published on the TrustAsia CA website.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.

Dates mentioned in this document, where time is omitted, default to 00:00:00 Beijing Time (UTC+8).

TrustAsia CA’s repository information will be published in a timely manner on the official website (https://www.trustasia.com/cps), or through other possible forms of information publication as needed. The published content includes CA Certificates, CP&CPS revisions, and other materials. These contents must remain consistent with the CP&CPS and relevant laws and regulations.

TrustAsia CA publishes the Certificate Revocation List (CRL) via HTTP. Subscribers or Relying Parties can obtain the CRL through the CRL Distribution Point address in the certificates issued by TrustAsia CA. Each CRL published by TrustAsia CA contains an incrementing serial number.

TrustAsia CA provides an Online Certificate Status Protocol (OCSP) service, allowing Subscribers or Relying Parties to query the status information of certificates in real time.

TrustAsia CA’s CP&CPS is available 24/7 through the repository. The CP&CPS is published at least once a year.

TrustAsia CA will regularly track changes to the BIMI Group MCR and adjust the CP&CPS in a timely manner to comply with the standards.

TrustAsia CA publishes the CRL for Subscriber Certificates at least every 7 days. For Subordinate CA Certificates, the CRL is published at least every 12 months. If a Subordinate CA Certificate is revoked, the CA Certificate’s CRL is updated and published within 24 hours.

Digital certificates issued by TrustAsia CA conform to the X.509 standard and assign a unique Distinguished Name (DN) to the certificate holder, using the X.500 standard naming format. The naming practices comply with RFC 5280 and the MCR. TrustAsia CA certificates contain the Subject DN of the issuing authority and the certificate subscriber, authenticating the identity and other attributes of the certificate applicant and recording their information with different identifiers. The certificate holder’s identity name is included in the certificate subject in the form of a DN, which is the unique DN of the certificate holder.

MC Certificate Subject attributes will not contain only metadata, such as ".", "-", and " " (i.e., space) characters, and any other indications that a value is missing, incomplete, or not applicable. The Subject Alternative Name extension must contain at least one entry, and each entry must contain a Fully Qualified Domain Name. Internal Names must not be used. Entries of dNSName conform to the preferred name syntax defined in RFC 5280 and do not contain underscore characters.

TrustAsia CA uses the DN (Distinguished Name) to identify the entities of the certificate subject and the certificate issuer. The name in the DN has certain representative significance and can be related to the identity or specific attributes of the end entity using the certificate. The Certificate Subject Name identifies the specific name of the end entity referred to by the certificate, describing the entity information bound to the public key in the subject’s public key.

TrustAsia CA does not issue anonymous or pseudonymous certificates for MC Certificates.

The digital certificates issued by TrustAsia CA comply with the X.509 V3 standard, and the Distinguished Name format complies with the X.500 standard. The naming rules for Distinguished Names are defined by TrustAsia CA.

Within the TrustAsia CA trust domain, the Subject DNs of different Subscribers' certificates cannot be the same and must be unique. However, for the same Subscriber, TrustAsia CA may issue multiple certificates using its unique Subject DN. When the same name appears among different Subscribers applying for certificates, the principle of "first applicant has priority" is followed, and the subsequent applicant must add additional identifying information to distinguish them.

Certificate applicants must not use names in their certificate applications that may infringe upon the intellectual property rights of others. TrustAsia CA does not verify the Subscriber’s right to use a trademark when issuing a certificate, nor is it responsible for resolving trademark-related disputes. TrustAsia CA may reject or revoke relevant certificates involved in trademark disputes.

Because the public key contained in a Mark Certificate will not be used, TrustAsia CA does not require the Applicant to prove possession of the associated private key. Subscribers can generate the private key themselves. The proof method can be submitting a digitally signed Certificate Signing Request (CSR) in PKCS#10 format.

The issuance target of TrustAsia CA’s certificates must be an Applicant, which is an organizational entity. However, during the certificate issuance process, TrustAsia CA will verify the personal identity of the Applicant Representative. The Applicant Representative must be a natural person and can be an authorized employee or authorized agent of the Applicant Organization. TrustAsia CA will use the validation methods in Section 3.2.2.1 to verify the Applicant’s intent to apply with the Applicant Representative.

The Applicant Representative may be required to submit a clear copy of a valid government-issued photo ID (such as a resident ID card, passport, driver’s license, military officer ID, or other equivalent document). TrustAsia CA will verify whether the copy of the document matches the requested name and whether other relevant information is correct.

For Business Entity type organizations applying for a Mark Certificate, TrustAsia CA will conduct a "face-to-face validation" of the "Principal Individual" in accordance with the requirements in Section 3.2.2.1.3.

Generally, except for the identity information that is explicitly and reliably required to be verified for the specific type of certificate, TrustAsia CA makes no commitment to the authenticity of unverified Subscriber information and assumes no related legal responsibilities. Information in the certificate must be verified, the validation must come from trusted third-party data sources, and unverified information must not be written into the certificate.

When an organizational Subscriber authorizes an Applicant Representative to handle certificate business, TrustAsia CA’s validation of the Applicant’s authorization includes:

TrustAsia CA will verify the names, titles, and authorizations of the Certificate Requester, Certificate Approver, and Contract Signer; and review whether these role personnel are listed on a denial list. If they are on the list, TrustAsia CA has the right to refuse to issue the certificate or require the replacement of relevant contacts. TrustAsia CA will contact the Certificate Requester or Certificate Approver using a valid communication method selected through the validation methods in Section 3.2.2.1, and obtain an affirmative response to verify the authenticity of the Applicant Representative applying for the certificate.

Certificate Requester: The submitter of the Mark Certificate application and the contact person for order review. The Certificate Requester is a natural person and can be an employee of the Applicant Organization or an authorized agent explicitly authorized to submit certificate applications on behalf of the Applicant Organization.

Certificate Approver: The approver for the Mark Certificate request. The Certificate Approver is a natural person and can be an employee of the Applicant Organization or an authorized agent explicitly authorized to approve certificate applications on behalf of the Applicant Organization.

Contract Signer: The signer of the Mark Certificate Subscriber Agreement. The Contract Signer is a natural person and can be an employee of the Applicant Organization or an authorized agent explicitly authorized to sign the Subscriber Agreement on behalf of the Applicant Organization.

The Applicant Organization may authorize one person to serve in two or more of these roles, and the Applicant Organization may also authorize more than one person to serve in any of these roles.

TrustAsia CA requires that the Contract Signer or a formally authorized individual must sign the Subscriber Agreement and agree to the terms of use. For the signature of the Subscriber Agreement, TrustAsia CA will require the Subscriber to complete it on the order page.

TrustAsia CA requires that the Certificate Approver must sign the certificate request. TrustAsia CA will send an online approval link via email, and the Certificate Approver completes the online approval.

Other electronic certification service organizations may interoperate with TrustAsia CA, but their CPS must comply with TrustAsia CA CP&CPS requirements and sign corresponding agreements with TrustAsia CA.

If national laws and regulations have provisions regarding this, TrustAsia CA will strictly implement them.

TrustAsia CA will disclose all Cross Certificates it issues.

TrustAsia CA supports key update requests for Subscribers with certificates within their validity period. Subscribers may choose to generate a new key pair to replace the currently used or soon-to-expire key pair.

TrustAsia CA does not provide key updates after a certificate has been revoked.

An Applicant or an individual authorized to apply for a certificate on behalf of the Applicant may submit a certificate application. The Applicant is responsible for any data provided to TrustAsia CA by itself or its authorized representative. TrustAsia CA maintains an internal database containing all previously revoked certificates and rejected certificate requests suspected of phishing or other fraudulent use, and uses this database to identify subsequent suspicious requests.

A VMC certificate application must be submitted by an authorized Certificate Requester and approved by a Certificate Approver. The certificate application must be accompanied by a Subscriber Agreement signed (in writing or electronically) by the Contract Signer.

After TrustAsia CA receives a Subscriber’s certificate application, the TrustAsia CA validation team will perform identification and authentication of the Subscriber’s identity in accordance with the requirements of Chapter 3.2 of this CP&CPS. TrustAsia CA will maintain systems and processes to sufficiently verify the Applicant’s identity according to the CP&CPS. The content of communications via phone, fax, or email will be securely stored along with all information directly provided by the Applicant through the TrustAsia CA WEB interface or API.

The Applicant information must contain at least one Fully Qualified Domain Name, which will be included in the Subject Alternative Name extension of the certificate.

For information in a Common Mark Certificate, if the data or proof document obtained by TrustAsia CA from the sources specified in Chapter 3.2 of this CP&CPS is not more than 398 days old and the information has not changed, TrustAsia CA may use that data or proof document; for a Verified Mark Certificate, if the data or proof document obtained by TrustAsia CA from the sources specified in Chapter 3.2 of this CP&CPS is not more than 1858 days old and the information has not changed, TrustAsia CA may use that data or proof document.

There is an exception to the above 398-day validation data reuse: TrustAsia CA maintains an up-to-date authorized representative system authorized by Subscribers. As long as the authorized representatives in this system maintain direct contact with TrustAsia CA during the certificate’s validity period, there is no need to re-verify the Subscriber.

TrustAsia CA does not issue certificates containing Internal Names or reserved IP addresses.

Under normal circumstances, TrustAsia CA will verify the Subscriber’s information and issue the certificate within a reasonable time frame. Unless otherwise agreed with the relevant Subscriber or stated in other agreements, no specific processing time is stipulated for completing a certificate application.

The certificate processing time largely depends on when the Subscriber provides the detailed information and documents required to complete the verification and whether they respond to TrustAsia CA’s management requirements in a timely manner. The certificate application request remains valid until it is rejected.

For Mark Certificates, prior to certificate issuance, a DNS CAA record check is performed for all domain names in the alternative names of the certificate application.

TrustAsia CA processes the "issuevmc" and "iodef" property tags in CAA records in accordance with the provisions of the MCR.

When processing property tags in CAA records, TrustAsia CA will not act upon the contents of the "iodef" property tag. TrustAsia CA recognizes critical tags, but if it encounters an unrecognized property set in a critical tag, it will refuse to issue the certificate.

If an "issuevmc" tag is present in the CAA record and its value does not contain "trustasia.com", TrustAsia CA will refuse to issue the corresponding certificate.

TrustAsia CA may still issue a certificate if the CAA query fails under the following circumstances:

TrustAsia CA will issue the certificate to the Subscriber within the validity period of the queried CAA record (the validity period is the TTL of the CAA record or 8 hours, whichever is greater); it will also log in detail any potential issuances blocked by CAA records.

For Subscriber certificates, TrustAsia CA confirms the source of the certificate request before issuance. Before issuing a Mark Certificate, a precertificate of that certificate will be logged into one or more approved Certificate Transparency logs.

During the issuance process, the RA administrator is responsible for approving the certificate application and sending the certificate issuance request to the CA’s certificate issuance system by operating the RA system. The certificate issuance request information sent by the RA to the CA must have RA identity authentication and information confidentiality measures to ensure that the request is sent to the correct CA certificate issuance system. After receiving the certificate issuance request, the CA certificate issuance system authenticates and decrypts the information from the RA.

The Root CA’s certificate issuance process involves a manual, explicit command issued by an individual authorized by TrustAsia CA (CA system operator, system administrator, or PKI administrator) so that the Root CA performs the certificate signing operation.

TrustAsia CA does not directly issue end-entity certificates from its Root Certificates.

Database storage and CA processes occurring during certificate issuance are protected against unauthorized modification.

For a valid certificate issuance request, the CA certificate issuance system sends it to the Subscriber.

TrustAsia CA deploys multi-factor authentication for all accounts capable of directly issuing certificates.

TrustAsia CA provides the certificate in any secure manner within a reasonable time after issuance. Usually, TrustAsia CA will email the certificate to the email address specified by the Subscriber during the application process.

The Subscriber is solely responsible for installing the issued certificate on the Subscriber’s computer or hardware security module.

Actions by which a Subscriber is deemed to have accepted the issued certificate include, but are not limited to:

TrustAsia CA considers the delivery of the certificate to the Subscriber as the publication of the certificate. Depending on the usage scenario of the Subscriber’s certificate and according to the requirements of the BIMI Group MCR, TrustAsia CA will also choose to publish the certificate in one or more recognized CT log servers.

TrustAsia CA will not notify other entities.

The Mark Certificate Subscriber’s private key requires no protection and may be discarded after use, as the public key is solely used to identify the mark representation and is not used to encrypt communications.

Relying Parties should consider the overall situation and the risk of loss before relying on a certificate.

When a Relying Party receives information loaded with a digital signature, it is obligated to perform the following confirmation operations:

If the above conditions are not met, the Relying Party is responsible for rejecting the signed information.

For Subscriber certificates issued by TrustAsia CA, certificate renewal can be performed before the certificate expires. The Subscriber may choose to retain the original key pair for certificate re-issuance. Before the certificate expires, TrustAsia CA will notify the Subscriber via email to renew the certificate.

If the Subscriber does not change the Certificate Subject DN and relevant identity information when submitting a certificate renewal request, and the original certificate’s validation time limit has not exceeded the period specified in Section 4.2.1 of this CP&CPS, TrustAsia CA may refer to the data and proof documents verified for the original certificate to validate the information for the renewed certificate.

If the Subscriber needs to change some certificate information when submitting a certificate renewal request, or if the original certificate’s validation time limit has exceeded the period specified in Section 4.2.1 of this CP&CPS, TrustAsia CA will perform validation according to the procedures and requirements for an initial certificate application.

If the Subscriber’s original certificate has already expired, applying for a certificate again will be validated according to the procedures and requirements for an initial certificate application.

The entity requesting certificate renewal is a Subscriber who has already applied for a TrustAsia CA certificate or their authorized representative.

For certificate renewal, the processing includes application identification and authentication, certificate information validation, and certificate issuance.

Same as Section 4.3.2 of the CP&CPS.

Same as Section 4.4.1 of the CP&CPS.

Same as Section 4.4.2 of the CP&CPS.

Same as Section 4.4.3 of the CP&CPS.

When the Subscriber’s certificate encounters the following circumstances, the Subscriber may choose the certificate key update service:

The entity requesting a certificate key update is a Subscriber who has already applied for a TrustAsia CA certificate and whose certificate has not expired, or their authorized representative.

TrustAsia CA processes certificate key update requests through the certificate renewal request processing workflow, as described in Section 4.6.3 of this CP&CPS.

Same as Section 4.3.2 of the CP&CPS.

Same as Section 4.4.1 of the CP&CPS.

Same as Section 4.4.2 of the CP&CPS.

Same as Section 4.4.3 of the CP&CPS.

Certificate modification may be initiated when non-subject information of the certificate changes.

The entity requesting a certificate modification is a Subscriber who has already applied for a TrustAsia CA certificate and whose certificate has not expired, or their authorized representative.

If the following conditions are met, a replacement certificate is issued based on a previously validated certificate request, provided the referenced certificate was not revoked due to fraud or other illegal acts:

Same as Section 4.3.2 of the CP&CPS.

Same as Section 4.4.1 of the CP&CPS.

Same as Section 4.4.2 of the CP&CPS.

Same as Section 4.4.3 of the CP&CPS.

The entities that can request certificate revocation are the Subscriber, TrustAsia CA, or judicial personnel authorized by judicial agencies. In addition, Relying Parties, Application Software Suppliers, Conflicting Trademark Owners, or other third parties may submit Certificate Problem Reports informing TrustAsia CA of reasonable grounds to revoke a certificate.

TrustAsia CA does not support a revocation request grace period.

Within 24 hours after receiving a revocation request, TrustAsia CA will investigate the facts and circumstances related to the revocation request and provide a preliminary investigation report to the Subscriber and the entity that submitted the revocation request. For infringement court orders, TrustAsia CA will verify the facts and take action within a commercially reasonable timeframe.

After reviewing the facts and circumstances, the CA will work with the Subscriber and the entity that escalated the preliminary report on the certificate or other revocation-related entities to determine whether to revoke the certificate or take other reasonable handling actions. If it is determined to revoke, the time from when the CA receives the revocation request or revocation-related notification to the publication of the revocation will not exceed the time frames specified in Section 4.9.1.1.

For the time of revocation, the CA will consider the following criteria:

As public information, the Certificate Revocation List (CRL) does not have security settings for read access. Relying Parties are free to query as needed, including querying the Certificate Revocation List, querying the certificate status through TrustAsia CA’s designated website, and querying via the Online Certificate Status Protocol (OCSP).

Before trusting this certificate, Relying Parties should proactively check the status of the certificate according to the latest CRL published by TrustAsia CA, and must also verify the reliability and integrity of the CRL to confirm the validity of the certificate.

The CRL can be accessed via a public HTTP URL. Within 24 hours of issuing the first certificate, the CA will produce and publish:

For CAs that issue Subscriber certificates:

For CAs that issue CA certificates:

The CA will continue to publish the CRL until the following occurs:

After generation, the TrustAsia CA CRL is automatically published to the public network. Generally, it takes effect within 1 hour, and at most within 24 hours.

The valid time interval of an OCSP response is the time difference between the thisUpdate and nextUpdate fields, inclusive. When calculating the time difference, 3,600 seconds equals one hour, and 86,400 seconds equals one day, ignoring leap seconds.

For the following certificate serial number situations, the certificate is marked as "assigned":

For certificates whose serial number is not marked as "assigned", they are marked as "unassigned".

The following applies to certificates and precertificates containing an Authority Information Access extension with the id-ad-ocsp access method.

The OCSP request service provided by TrustAsia CA supports both GET and POST methods. TrustAsia CA processes the Nonce extension (1.3.6.1.5.5.7.48.1.2) in accordance with the provisions of RFC 8954.

For the status of Subscriber or Pre-signed certificates:

If the valid time interval of the OCSP response is greater than or equal to sixteen hours, TrustAsia CA updates the information provided via the Online Certificate Status Protocol at least eight hours before nextUpdate and no later than four days after thisUpdate. The valid time interval for Subscriber certificate OCSP responses is greater than or equal to eight hours and less than or equal to ten days.

For the status of Subordinate CA certificates:

TrustAsia CA updates the information provided via the Online Certificate Status Protocol at least every twelve months; and updates the information within 24 hours after revoking a Subordinate CA certificate.

The following applies to the certificate status to which the OCSP responder is required to respond.

The OCSP responses provided by TrustAsia CA comply with RFC 6960 and/or RFC 5019. The OCSP response meets either of the following conditions:

If the OCSP responder receives a certificate status request for an "unassigned" serial number, the responder does not respond with a "good" status.

Consistent with RFC 6960.

Not applicable.

If a Subscriber or TrustAsia CA discovers or suspects that a private key has been compromised, immediate measures should be taken to revoke the certificate with the compromised key and reissue the certificate according to the CP&CPS requirements.

Any Relying Party who discovers a private key compromise may report it to TrustAsia CA via email (revoke@trustasia.com). The email must provide evidence of the private key compromise:

TrustAsia CA does not support certificate suspension.

Not applicable.

Not applicable.

Not applicable.

Certificate status information is available via CRL and OCSP responses.

For revoked certificates, TrustAsia CA does not remove their revocation records from the CRL and OCSP before the certificate expires.

The certificate status service is provided 24/7. TrustAsia CA operates and maintains its CRL and OCSP capabilities with sufficient resources to provide a response time of 10 seconds or less under normal operating conditions.

TrustAsia CA responds 24/7 to high-priority certificate problem reports. Where appropriate, TrustAsia CA will forward such issues to law enforcement agencies and revoke the subject certificates associated with such issues.

The OCSP responder may not be applicable to all certificate types.

The construction of TrustAsia CA’s computer rooms and systems is implemented in accordance with the following standards:

The TrustAsia CA data center has installed an access control system with the following functions:

The entire area also has a video surveillance system with no blind spots, providing 24/7 continuous recording of important passages inside and outside the site. All video data is kept for at least 3 months, and videos of major incidents are archived separately for future inquiry. Intrusion detection alarms, environmental control detection alarms, and audible/visual alarms are installed, while simultaneously notifying operations and maintenance personnel.

TrustAsia CA has a secure and reliable power supply system and a dual-feed backup power system to ensure 24/7 normal power supply for the system and provide normal service in the event of a power interruption. In addition, dedicated diesel generators are used, which can provide more than 12 hours of endurance for all racks in the new computer room at full load.

The computer room has an air conditioning system to control the temperature and humidity in the operating facility. The power is configured according to the number of racks in each room and equipment at full load.

TrustAsia CA’s computer room is elevated 1.45 meters above the ground and is equipped with a water leak alarm system. In the event of a flood, the system will immediately issue an alarm and notify relevant personnel to take emergency measures.

The fire alarm system of TrustAsia CA’s computer room uses a cabinet-type Heptafluoropropane automatic fire extinguishing device. The system collects fire data through temperature and smoke sensors installed in the computer room, while also supplying the system to process alarm data from user automatic fire alarm terminals and system operational status data in real-time.

System management is divided into manual mode and automatic mode, enabling real-time detection and monitoring of the network system, setting manual and automatic control modes, and completing various associated linkage actions designed for the system.

TrustAsia CA stores media containing audit, archive, and backup information in secure facilities protected by physical access controls. Only authorized personnel are allowed access, and at least two trusted persons must be present. A media usage registry is used to record the status of the media, and measures are taken to prevent accidental damage to the media.

TrustAsia CA shreds unused paper documents and data CDs, rendering the information unrecoverable. Before cryptographic equipment is disposed of, it is initialized and physically destroyed according to the method provided by the equipment manufacturer.

When processing obsolete content, at least two trusted persons must be present.

TrustAsia CA uses offline media to back up critical data and audit log data and transports it to an off-site location for storage. The storage facility meets the description for media storage in Section 5.1.6.

During the process of providing electronic certification services, TrustAsia CA considers positions involving key operations that can substantially affect the issuance, use, management, and revocation of certificates as trusted roles. These roles include, but are not limited to:

Trusted roles are appointed by management. The list of personnel appointed to trusted roles is maintained and reviewed annually.

TrustAsia CA strictly controls critical tasks within its specific operational specifications. The following sensitive operations require multiple trusted roles to be completed collaboratively, for example:

Before TrustAsia CA allows any personnel to access and execute the systems necessary for their trusted roles, they are required to authenticate to the CA and RA systems. For example:

To ensure system security, TrustAsia CA adheres to the principle of separation of trusted roles, meaning TrustAsia CA’s trusted roles are held by different individuals. For MC Certificates, TrustAsia CA ensures that no single person can independently verify and authorize the issuance of such certificates, and such controls are auditable.

The qualification requirements for TrustAsia CA staff holding trusted roles are as follows:

TrustAsia CA, or in cooperation with relevant government departments and investigation agencies, completes background checks on trusted employees. All trusted employees and trusted employees transferring in must provide written consent to undergo a background check. The background check must comply with the requirements of laws and regulations; the content, methods, and personnel conducting the investigation must not violate laws and regulations. The background check should use legal means to verify the individual’s background information as much as possible through relevant organizations and departments.

Background checks are divided into: basic investigations and comprehensive investigations. Basic investigations include checks on work experience, professional references, education, and social relations. Comprehensive investigations include basic investigation items as well as checks on criminal records, social relations, and social security. Personnel in critical positions for public trust certificate businesses must undergo comprehensive investigations.

The Human Resources Department investigation procedures include:

TrustAsia CA provides appropriate pre-job training according to the position requirements of trusted roles and keeps records of employees' training participation in files. These trainings include:

Validation personnel performing information validation duties must receive all the above training before taking up their posts to ensure they can satisfactorily perform their duties. Validation personnel must pass related knowledge assessments periodically arranged by TrustAsia CA to ensure they possess the necessary skills to fulfill their duties.

Personnel acting in trusted roles or other important roles shall irregularly undergo training organized by TrustAsia CA. For personnel related to certification system operations, relevant skills and knowledge training should reach a level consistent with the job requirements. Furthermore, TrustAsia CA will irregularly require personnel to undergo continuous training based on requirements such as organizational system upgrades and policy adjustments.

The job rotation cycle and sequence for active personnel at TrustAsia CA will be determined based on the organization’s security management policies.

When active personnel use TrustAsia CA systems to perform certification business operations without authorization or beyond their authorization, once confirmed, TrustAsia CA will immediately revoke the person’s login certificate and terminate their system access permissions. Depending on the severity of the person’s unauthorized actions, measures will be implemented, including adjusting the person’s job position, circulating a notice of criticism, imposing fines, dismissal, and submitting the matter to judicial agencies for handling.

TrustAsia CA does not currently employ external independent contractors to engage in certification-related work.

The documentation TrustAsia CA typically provides to personnel includes, but is not limited to, the following categories:

TrustAsia CA will record the details of actions taken to process certificate applications and issue certificates, including all information generated and documents received related to the certificate application, time and date, and the personnel involved.

If TrustAsia CA’s applications cannot automatically log events, manual procedures will be implemented to meet the requirements.

These events include, but are not limited to:

Logging records generally must include:

Irregularly process the system’s automatic logs and the operators' manual records.

Irregularly process system security logs, track processing, and inspect major events that violate policies and specifications.

TrustAsia CA retains the following logs for at least two years:

TrustAsia CA’s audit logs are stored in a database and backed up; this includes the audit information and event records in the related documents.

TrustAsia CA implements strict physical and logical access control measures to ensure that only authorized personnel can access these audit records, and unauthorized access, reading, modification, and deletion operations are strictly prohibited.

TrustAsia CA’s system logs are synchronized in real-time to the log server and irregularly backed up to an off-site location; manual paper records are periodically archived and stored in dedicated filing cabinets.

Regarding electronic audit information, TrustAsia CA’s audit log collection system involves:

For paper audit information, dedicated filing cabinets are used to achieve collection and archiving.

When TrustAsia CA discovers that it is under attack, it will log the attacker’s actions, trace the attacker within the scope permitted by law, and reserve the right to take corresponding countermeasures. TrustAsia CA reserves the right to decide whether to notify the entities related to the event.

TrustAsia CA performs a risk assessment annually:

In addition to archiving the relevant content in Section 5.4.1, TrustAsia CA also archives and logs the following types of events, including but not limited to:

Archived audit logs (as described in Section 5.5.1) will be retained for at least 2 years from the time their record was created, or the time required by Section 5.4.3, whichever is longer.

Records retained by TrustAsia CA for at least 2 years include:

TrustAsia CA has secure physical and logical protections for archived documents in both electronic and paper forms. Furthermore, there are strict management procedures to ensure that archived documents are not damaged, preventing unauthorized access, modification, deletion, and other actions.

System-generated electronic records are periodically backed up, and the backups are stored off-site in the form of offline media; manual electronic records are collected and backed up on internal storage servers.

Paper documents do not require backup, but strict security measures are taken to ensure their safety and prevent unauthorized access, modification, deletion, and other actions.

When creating archived records, TrustAsia CA will automatically timestamp them using system time (non-cryptographic method). TrustAsia CA’s time source server time is synchronized with a Universal Coordinated Time (UTC) time source recognized by the national measurement institute.

System-generated electronic records are synchronized in real-time to the log server and irregularly backed up off-site.

For manual electronic records, the collection and backup work is completed by internal storage servers.

Written archival materials are collected and archived in filing cabinets.

TrustAsia CA has adopted physical and logical access control methods to ensure that only authorized personnel can access these archived information; unauthorized access, reading, modification, and deletion operations are strictly prohibited.

TrustAsia CA formulates and records a business continuity plan and disaster recovery plan to notify software suppliers, Subscribers, and Relying Parties in the event of a disaster, security incident, or business impairment. TrustAsia CA does not publicly disclose the business continuity plan, but it is subject to audit by auditors; these procedures are tested, reviewed, and updated annually. The business continuity plan includes:

TrustAsia CA has backed up the resources, software, and data of its business systems and other important systems, and has established corresponding emergency handling processes. When disasters occur such as destruction of network communication resources, inability of computer equipment to provide normal services, software corruption, database tampering, or due to force majeure, TrustAsia CA will implement recovery according to the disaster recovery plan.

When the private key of TrustAsia CA’s Root CA or Subordinate CA is compromised, TrustAsia CA will carry out emergency handling according to the key contingency plan and revoke all certificates issued by that CA.

In the event of a major disaster at the physical site, TrustAsia CA will restore partial services within 48 hours according to the business continuity plan.

Not applicable.

As part of the certificate application process, the Subscriber generates a key pair and submits the public key to TrustAsia CA within a CSR.

TrustAsia CA’s public keys are included in the self-signed Root CA certificates and Subordinate CA certificates issued by TrustAsia CA. Subscribers and Relying Parties can download Root CA certificates and Subordinate CA certificates from TrustAsia CA’s official website.

To ensure the security strength of the keys, TrustAsia CA uses lint tools for key length detection before issuing certificates to ensure that the keys of different types of TrustAsia CA certificates comply with the following standards:

Both TrustAsia CA and the Subscriber must generate public keys in accordance with the provisions in Section 6.1.1 of this CP&CPS. The public key parameters are generated by compliant equipment/platforms to ensure the quality of the public key parameters. The public key must meet the requirements in Section 6.1.5 of this CP&CPS.

Before issuing a certificate, TrustAsia CA performs public key parameter detection to ensure the public key parameters satisfy the following:

The validity of all keys is confirmed through a full ECC public key validation routine or a partial ECC public key validation routine.

The X.509 v3 certificates issued by TrustAsia CA include the key usage extension, which complies with the RFC 5280 standard. For the usages specified by TrustAsia CA in the key usage extension of its issued certificates, the Certificate Subscriber must use the keys according to these specified usages.

Root CA keys are generally used to issue the following certificates and CRLs:

Subordinate CA keys are generally used to issue the following certificates and CRLs:

The cryptographic modules used by TrustAsia CA for CA key pairs and timestamp key pairs comply with the FIPS 140-2 Level 3 standard.

Operations such as generating, updating, revoking, backing up, and restoring TrustAsia CA private keys utilize a multi-person control mechanism. Management authority over the private keys is distributed among 5 key administrators. At least 3 or more key administrators must be present and grant permission by inserting their administrator IC cards or USB Keys and entering their PINs to perform operations on the private keys.

TrustAsia CA will not escrow private keys.

See Section 5.2.2 of this CPS. In addition, TrustAsia CA backs up the Root private key and CA private keys. According to the operational specifications provided by the cryptographic equipment manufacturer, backup cipher-text files and backup recovery permission IC cards or USB Keys are generated and stored in the company’s safes (or safe deposit boxes at a bank with a security level no lower than the local backup site).

TrustAsia CA does not archive private keys for Subscriber certificates, nor are any CA certificate private keys archived by a third party.

TrustAsia CA key pairs are generated, stored, and used on hardware cryptographic modules. For recovery purposes, TrustAsia CA backs up the CA keys under multi-person control according to the operational specifications provided by the cryptographic equipment manufacturer.

Additionally, TrustAsia CA has strict key management processes to control the duplication of CA key pairs. All these effectively prevent the loss, theft, modification, unauthorized disclosure, or unauthorized use of CA private keys.

TrustAsia CA private keys are stored in encrypted form in hardware cryptographic modules complying with the FIPS 140-2 Level 3 standard, and the use of the private keys also occurs within the hardware cryptographic modules.

TrustAsia CA private keys are stored in hardware cryptographic modules. Activation requires following Section 6.2.2 of this CP&CPS, where under the presence and permission of at least half of the key administrators, the operator permissions of the cryptographic equipment are used to achieve this. When CA private keys need to be used (online or offline), the key administrators must provide operator IC cards or USB Keys and enter the PIN to complete the operation.

For TrustAsia CA private keys, when the CA system issues a logout command to the cryptographic module, or the cryptographic management software issues a shutdown command to the cryptographic module, or the hardware cryptographic module storing the private key loses power, the private key enters a deactivated state.

The operation to deactivate the private key is performed by a key administrator using their own administrator card to log into the server cryptographic machine and entering the PIN, with the presence and permission of at least half of the key administrators.

After the lifecycle of the TrustAsia CA private key ends, TrustAsia CA will retain the CA private key in a backup hardware cryptographic module, while other CA private key backups are securely destroyed. Meanwhile, all PIN codes, IC cards, or USB Keys used to activate the private key must also be destroyed.

The CA must not destroy its private keys before their commercial purpose or application has lost value, or legal obligations expire.

Archived CA private keys, after their archival period ends, or when CA private key backups or copies are no longer used for valid commercial purposes, must be securely destroyed with the participation of multiple trusted persons. The destruction of CA private keys will ensure that the CA private keys are completely deleted from the hardware cryptographic module, leaving no residual information.

Refer to Section 6.2.1 of this CP&CPS.

For TrustAsia CA public key archival, refer to Section 5.5.

The maximum validity period for the end Subscriber certificate of a Mark Certificate does not exceed 398 days. If it is a licensee of a registered trademark or word mark rather than the trademark registrant, the certificate’s expiration date will not be later than the final expiration date of the Subscriber’s possession of the registered trademark or word mark.

The activation data for TrustAsia CA private keys is generated by cryptographic equipment in the presence and with the permission of at least half of the key administrators, according to the operational specifications provided by the cryptographic equipment manufacturer.

The activation data for Subscriber private keys, including passwords used to download certificates (provided in the form of secure envelopes), USB Keys, login passwords for IC cards, etc., must be generated in a secure and reliable environment. This activation data is delivered to the Subscriber through secure and reliable methods, such as in-person delivery offline, special express mail, etc. For non-single-use activation data, TrustAsia CA recommends that users modify it themselves.

If the activation data for the Subscriber certificate private key is a password, these passwords must:

For CA private key activation data (smart IC cards, PIN codes), TrustAsia CA ensures they are held by trusted personnel themselves in a reliable manner. All trusted personnel are required to memorize their passwords rather than writing them down or sharing them with others.

When private key activation data is transmitted, it should be protected from loss, theft, modification, unauthorized disclosure, or unauthorized use during transmission.

When private key activation data is no longer needed, it will be destroyed and protected from loss, theft, disclosure, or unauthorized use during this process. The result of the destruction is that part or all of the activation data cannot be obtained directly or indirectly from residual information or media. For example, papers recording passwords must be shredded.

The information security management of the CA system, acting in accordance with the national standard "Cryptographic and Related Security Technical Specifications for Certificate Authority Systems", the "Electronic Authentication Service Management Measures" promulgated by the Ministry of Industry and Information Technology, the ISO 27001 information security management system requirements, and other relevant information security standards, has established comprehensive and complete security management policies and systems, which are implemented, reviewed, and recorded during operations. The primary technical security and control measures include: identification and authentication, logical access control, network access control, etc.

Multi-factor authentication is implemented for all accounts that can directly result in certificate issuance.

System operation and maintenance personnel log into the system through a bastion host to perform operations, ensuring that CA software and data files are secure, reliable, and not subject to unauthorized access.

Core systems must be physically separated from other systems, and production systems are logically isolated from other systems. This separation can prevent unauthorized network access. Firewalls are used to prevent unauthorized access to the production system network from both internal and external networks, restricting activities accessing the production system. Only trusted personnel in the CA system operation and management group with necessary work needs and system access can access the CA database via passwords.

TrustAsia CA’s CA system and its operational environment have passed third-party security assessments and penetration tests, obtaining the corresponding test reports.

TrustAsia CA’s software design and development process follows these principles:

TrustAsia CA has established various security policies, management systems, and processes to conduct security management of the certification system.

Information security management of the certification system operates strictly following the relevant operation management specifications of the State Cryptography Administration.

There are strict control measures over the use of the certification system. All systems are only put into secure use after rigorous testing and verification, and any modifications and upgrades are recorded on file.

TrustAsia CA regularly performs security inspections on the system to identify whether equipment has been compromised, whether security vulnerabilities exist, etc.

TrustAsia CA controls the research, development, and deployment of the certificate authentication system through internal change control processes to ensure the system is secure and reliable.

The certificate complies with the X.509 V3 certificate format, and the version information is stored in the certificate version format field.

Based on the requirements of RFC 5280, TrustAsia CA applies the following configurations to all issued certificates.

This section describes the encoding rules applicable to all certificates issued by the CA. Further restrictions may be specified in Section 7.1.2, but these restrictions do not supersede these requirements.

For each valid certification path (as defined by RFC 5280 Section 6) from TrustAsia CA:

When encoding a Name:

This extension is not used.

Not applicable.

Not applicable.

Not applicable.

TrustAsia CA’s Certificate Revocation List complies with the X.509 v2 version and format requirements.

CRL Extensions:

Revoked Certificate Component:

crlEntryExtensions Component:

OCSP Version 1 defined by RFC 6960.

Consistent with RFC 6960. The singleExtensions of an OCSP response do not contain the reasonCode (OID 2.5.29.21) CRL entry extension.

This CP&CPS terminates when TrustAsia CA ceases operations.

After this CP&CPS terminates, its effect will simultaneously terminate, but for legal facts occurring before the date of termination, the provisions on the responsibilities of the parties and the exemption of responsibilities in this CP&CPS still apply, including but not limited to the contents involving auditing, confidential information, privacy protection, intellectual property rights, and limited liability clauses for compensation in the CP&CPS, which continue to be effective after this CP&CPS terminates.

When certain provisions in the CP&CPS, Subscriber Agreement, Relying Party Agreement, and other agreements become invalid due to certain reasons, such as content modification or conflict with applicable laws, it does not affect the legal validity of other provisions in the documents.

Authorized by the TrustAsia CA Security Policy Committee, the CPS writing group reviews this CP&CPS at least annually to ensure it complies with national laws, regulations, the requirements of competent authorities, relevant international standards, and the actual needs of certification business operations.

For modifications and updates to this CP&CPS, the CPS writing group proposes revision suggestions. After approval by the TrustAsia CA Security Policy Committee, the CPS writing group is responsible for completing the revisions. The revised CP&CPS is officially published after being approved by the TrustAsia CA Security Policy Committee.

The revised CP&CPS will be published immediately on TrustAsia CA’s official website upon approval. For modifications that require notification via email, mail, media, etc., TrustAsia CA will notify relevant parties within a reasonable time, which should ensure minimal impact on the concerned parties.

TrustAsia CA has the sole authority to determine whether an amendment to the CP&CPS requires a change to the OID.

Circumstances under which TrustAsia CA must modify this CP&CPS include: inconsistencies between relevant contents in the CP&CPS and governing laws, explicit change or adjustment requirements from national regulatory authorities regarding the organization’s certification business, etc.

The complete document structure of this CP&CPS includes three parts: title, table of contents, and main body. Alternative content following modifications to the table of contents and main body will fully replace all previous parts and be placed on TrustAsia CA’s website for reference and browsing.

TrustAsia CA declares that according to the rights and obligations of the certification entities detailed in this CP&CPS, the parties cannot make assignments in any way without the prior written consent of TrustAsia CA.

In the event of a conflict between a requirement of this CP&CPS and the laws, regulations, or government orders of any jurisdiction within mainland China (hereinafter referred to as "Laws"), TrustAsia CA will modify any conflicting requirement to the minimum extent necessary to make it legally effective within that jurisdiction. This applies only to operations or certificate issuances subject to that Law. In such cases, TrustAsia CA will immediately (and prior to issuing certificates under the modified requirement) detail the specific Law in Section 9.16.3 of this CP&CPS, as well as the related modifications specifically implementing these requirements.

Furthermore, TrustAsia CA will (and prior to issuing certificates under the modified requirement) notify the BIMI Group Working Group of the newly added relevant content in its CPS by sending a message and receiving a confirmation receipt, so that the BIMI Group Working Group may consider possible revisions to the MCR accordingly.

Any modification made by TrustAsia CA based on the MCR shall be terminated if either of the following occurs:

In such cases, the following three tasks must be completed within 90 days (as stated above):

TrustAsia CA states that if Certificate Subscribers, Relying Parties, and other entities fail to enforce a provision of this CP&CPS, it shall not be deemed that the entity will not enforce that or other provisions in the future.

If a violation, delay, or inability to perform the warranty liabilities stipulated in this CP&CPS is caused by force majeure such as war, plague, fire, earthquake, or natural disaster, TrustAsia CA will not be responsible for such events.