註冊中心（RA）

Registration Authorities

With the exception of Section 3.2.2.4, Section 3.2.2.5 and (effective 2026-03-15) Section 3.2.2.8, the CA MAY delegate the performance of all, or any part, of Section 3.2 requirements to a Delegated Third Party, provided that the process as a whole fulfills all of the requirements of Section 3.2.

除第 3.2.2.4 節、第 3.2.2.5 節 及（自 2026-03-15 起生效）第 3.2.2.8 節之要求外，CA 得（MAY）將第 3.2 節規定之全部或任何部分要求，委派給受委任第三方（Delegated Third Party）執行，前提是整體流程完全符合第 3.2 節所有要求。

Before the CA authorizes a Delegated Third Party to perform a delegated function, the CA SHALL contractually require the Delegated Third Party to:

於 CA 授權受委任第三方執行受委託作業（delegated function）之前，CA 應（SHALL）透過契約要求受委任第三方：

1. Meet the qualification requirements of Section 5.3.1, when applicable to the delegated function;
2. Retain documentation in accordance with Section 5.5.2;
3. Abide by the other provisions of these Requirements that are applicable to the delegated function; and
4. Comply with
   1. the CA’s Certificate Policy/Certification Practice Statement or
   2. the Delegated Third Party’s practice statement that the CA has verified complies with these Requirements.

1. 於受委託作業適用時，應符合第 5.3.1 節所規定之資格要求；
2. 依第 5.5.2 節保留文件；
3. 遵守本文件中其他適用於受委託作業之規定；以及
4. 遵循
   1. CA 的憑證政策（CP）／憑證實務作業基準（CPS），或
   2. 受委任第三方之作業基準，且 CA 已驗證其遵循本文件要求。

The CA MAY designate an Enterprise RA to verify certificate requests from the Enterprise RA’s own organization.

CA 得（MAY）指定企業註冊中心（Enterprise RA）驗證其所屬組織提出的憑證申請。

The CA SHALL NOT accept certificate requests authorized by an Enterprise RA unless the following requirements are satisfied:

CA 不得（SHALL NOT）接受由企業註冊中心核准的憑證申請，除非符合下列要求：

1. The CA SHALL confirm that the requested Fully-Qualified Domain Name(s) are within the Enterprise RA’s verified Domain Namespace.
2. If the certificate request includes a Subject name of a type other than a Fully-Qualified Domain Name, the CA SHALL confirm that the name is either that of the delegated enterprise, or an Affiliate of the delegated enterprise, or that the delegated enterprise is an agent of the named Subject. For example, the CA SHALL NOT issue a Certificate containing the Subject name “XYZ Co.” on the authority of Enterprise RA “ABC Co.”, unless the two companies are affiliated (see Section 3.2) or “ABC Co.” is the agent of “XYZ Co”. This requirement applies regardless of whether the accompanying requested Subject FQDN falls within the Domain Namespace of ABC Co.’s Registered Domain Name.

1. CA 應（SHALL）確認所申請之完全吻合網域名稱（Fully-Qualified Domain Name，FQDN）位於該企業註冊中心已驗證之網域名稱空間（Domain Namespace）內。
2. 如憑證申請包含非完全吻合網域名稱（FQDN）類型之主體名稱（Subject name），CA 應（SHALL）確認該名稱為受委任企業之名稱、受委任企業的關係企業（Affiliate）之名稱，或受委任企業係該主體所載名稱之代理人。例如，CA 不得（SHALL NOT）僅憑企業註冊中心「ABC Co.」之授權而簽發包含主體名稱「XYZ Co.」之憑證，除非兩家公司為關係企業（參見第 3.2 節）或「ABC Co.」係「XYZ Co.」之代理人。無論伴隨申請之主體 FQDN（Subject FQDN）是否屬於「ABC Co.」已註冊域名之網域名稱空間內，上述要求均應適用。

The CA SHALL impose these limitations as a contractual requirement on the Enterprise RA and monitor compliance by the Enterprise RA.

CA 應（SHALL）透過契約要求該企業註冊中心遵守上述限制，並監督其遵循情形。