<?xml version="1.0" encoding="UTF-8"?>

<fragment version="1.0">
  <!-- Trust root policy for manufacturer device certificate-->
  <!--*****************************************************************-->
  <!--  Nokia Content Signing CA For MIDlet Signing on device Manufacturer Domain Cert -->
  <!--*****************************************************************-->
  <!--Bind Nokia Content Signing CA.crt cert (Nokia Content Signing CA For MIDlet Signing) to *MFD* domain-->
  <trustroot>
    <certificate>
      <device>
        <name>Nokia_Content_Signing_CA</name>
        <access>
          <delete/>
          <disable/>
        </access>
      </device>
    </certificate>
    <binding>
      <volatile/>
      <domain>*MFD*</domain>
    </binding>
  </trustroot>
  <!-- Trust root policy for manufacturer device certificate-->
  <!--*****************************************************************-->
  <!--  Nokia Online Signing CA For MIDlet Signing on device Manufacturer Domain Cert -->
  <!--*****************************************************************-->
  <!--Bind nokiaonlineca.cer cert (Nokia Content Signing CA For MIDlet Signing) to *MFD* domain-->
  <trustroot>
    <certificate>
      <device>
        <name>nokiaonlineca</name>
        <access>
          <delete/>
          <disable/>
        </access>
      </device>
    </certificate>
    <binding>
      <volatile/>
      <domain>*MFD*</domain>
    </binding>
  </trustroot>
  <!--Trust root policies for third-party device certificates-->
  <!--*****************************************************************-->
  <!--  Thawte Premium Server CA For Java Signing on device Trusted Third Party Domain Cert -->
  <!--*****************************************************************-->
  <!--Bind thawtepremium.cer cert (Thawte Premium Server CA For Java Signing) to *TTPD* domain-->
  <trustroot>
    <certificate>
      <device>
        <name>thawtepremium</name>
        <access>
          <delete/>
          <disable/>
        </access>
      </device>
    </certificate>
    <binding>
      <volatile/>
      <domain>*TTPD*</domain>
    </binding>
  </trustroot>
  <!--Trust root policies for third-party device certificates-->
  <!--*****************************************************************-->
  <!--  GeoTrust CA for UTI (aka Java Verified) on device Trusted Third Party Domain Cert -->
  <!--*****************************************************************-->
  <!--Bind UTI_Root_cer.der cert (GeoTrust CA for UTI (aka Java Verified)) to *TTPD* domain-->
  <trustroot>
    <certificate>
      <device>
        <name>UTI_Root_cer</name>
        <access>
          <delete/>
          <disable/>
        </access>
      </device>
    </certificate>
    <binding>
      <volatile/>
      <domain>*TTPD*</domain>
    </binding>
  </trustroot>
  <!--Trust root policies for third-party device certificates-->
  <!--*****************************************************************-->
  <!--  VeriSign Class 3 CA on device Trusted Third Party Domain Cert -->
  <!--*****************************************************************-->
  <!--Bind PCA3ss_v4.der cert (VeriSign Class 3) to *TTPD* domain-->
  <trustroot>
    <certificate>
      <device>
        <name>PCA3ss_v4_509</name>
        <access>
          <delete/>
          <disable/>
        </access>
      </device>
    </certificate>
    <binding>
      <volatile/>
      <domain>*TTPD*</domain>
    </binding>
  </trustroot>

<!--  SIM CERTIFICATES  -->
	<!-- Bind trusted certificates found from SIM to Operator and TTP domains -->
	<trustroot>
		<priority>1</priority>
		<certificate>
			<cryptotoken>
				<location>
					<path>trustedCertificates</path>
				</location>
				<constraint>
					<trustedusage>
						<oid>1.3.6.1.4.1.42.2.110.2.2.2.1</oid>
					</trustedusage>
				</constraint>
			</cryptotoken>
		</certificate>
		<binding>
			<volatile/>
			<domain>*OPD*</domain>
		</binding>
	</trustroot>

	<trustroot>
		<certificate>
			<cryptotoken>
				<location>
					<path>trustedCertificates</path>
				</location>
				<constraint>
					<not>
						<trustedusage>
							<oid>1.3.6.1.4.1.42.2.110.2.2.2.1</oid>
						</trustedusage>
					</not>
				</constraint>
			</cryptotoken>
		</certificate>
		<binding>
			<volatile/>
			<domain>*TTPD*</domain>
		</binding>
	</trustroot>

</fragment>
