# CA Owner Audit Dump - Actalis

Generated: 2026-07-28T06:44:07.324681Z

## CA Owner Summary

- Name: Actalis
- Country: Italy
- Website: -
- Problem Reporting: cert-problem[at]actalis[dot]it, https://www.actalis.it/products/ssl-certificate.aspx
- CP/CPS URLs: https://www.actalis.com/legal-repository, https://www.actalis.com/cp-cps-code-signing-certificates, https://www.actalis.com/cp-cps-smime-certificates, https://www.actalis.com/cps-for-tsl-server-certificates, https://github.com/Actalis-CA/CP-CPS/raw/refs/heads/main/CPS/CodeSigning_CP_CPS_v1.0.md, https://github.com/Actalis-CA/CP-CPS/raw/refs/heads/main/CPS/SMIME_CP_CPS_v1.0.md, https://raw.githubusercontent.com/Actalis-CA/CP-CPS/refs/heads/main/CPS/TLS_CP_CPS_v6.0.md, https://www.agid.gov.it/it/piattaforme/posta-elettronica-certificata/certificati-gestori-pec-siti-web, https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_tls_v1.0_en_20260717.pdf, https://raw.githubusercontent.com/AgID/ca-agid-ca1/refs/heads/master/ICSPC-SIA-SPKI-Manuale%20Operativo%20AgID%20TLS_EN_20260717.md, https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v6.0_del_29-11-2021.pdf, https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v10.0_en_20260716.pdf, https://raw.githubusercontent.com/AgID/ca-agid-ca1/refs/heads/master/ICSPC-SIA-SPKI-Manuale%20Operativo%20AgID%20CA%20v10.0_EN_20260716.md, https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v8.0.pdf
- Audit URLs: http://www.actalis.it/documenti-en/actalisca_audit_statement.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_Standard_Audit_v2_signedTS.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_TLS-BR_Audit_v2_signedTS.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_TLS-EV_Audit_v2_signedTS.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_SMIME-BR_Audit_v2_signedTS.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_CS-BR_Audit_v2_signedTS.pdf
- Root Programs: {"mozilla":"Not Yet Included","chrome":"Not Included","microsoft":"Disabled","apple":"Not Included"}

## Owner Disclosure Snapshot

- Problem reporting mechanism: cert-problem[at]actalis[dot]it, https://www.actalis.it/products/ssl-certificate.aspx
- CP/CPS URLs: https://www.actalis.com/legal-repository, https://www.actalis.com/cp-cps-code-signing-certificates, https://www.actalis.com/cp-cps-smime-certificates, https://www.actalis.com/cps-for-tsl-server-certificates, https://github.com/Actalis-CA/CP-CPS/raw/refs/heads/main/CPS/CodeSigning_CP_CPS_v1.0.md, https://github.com/Actalis-CA/CP-CPS/raw/refs/heads/main/CPS/SMIME_CP_CPS_v1.0.md, https://raw.githubusercontent.com/Actalis-CA/CP-CPS/refs/heads/main/CPS/TLS_CP_CPS_v6.0.md, https://www.agid.gov.it/it/piattaforme/posta-elettronica-certificata/certificati-gestori-pec-siti-web, https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_tls_v1.0_en_20260717.pdf, https://raw.githubusercontent.com/AgID/ca-agid-ca1/refs/heads/master/ICSPC-SIA-SPKI-Manuale%20Operativo%20AgID%20TLS_EN_20260717.md, https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v6.0_del_29-11-2021.pdf, https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v10.0_en_20260716.pdf, https://raw.githubusercontent.com/AgID/ca-agid-ca1/refs/heads/master/ICSPC-SIA-SPKI-Manuale%20Operativo%20AgID%20CA%20v10.0_EN_20260716.md, https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v8.0.pdf
- Audit URLs: http://www.actalis.it/documenti-en/actalisca_audit_statement.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_Standard_Audit_v2_signedTS.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_TLS-BR_Audit_v2_signedTS.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_TLS-EV_Audit_v2_signedTS.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_SMIME-BR_Audit_v2_signedTS.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_CS-BR_Audit_v2_signedTS.pdf
- Repository URLs: https://www.actalis.com/legal-repository, https://www.agid.gov.it/it/piattaforme/posta-elettronica-certificata/certificati-gestori-pec-siti-web
- Root programs: {"mozilla":"Not Yet Included","chrome":"Not Included","microsoft":"Disabled","apple":"Not Included"}
- Contact aliases: -

## Certificate Inventory

| # | Subject | CA | Lifecycle | Validity | Policies | pathLen | EKU | zlint |
|---|---|---|---|---|---|---|---|---|
| 1 | countryName=IT, localityName=Milano, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication CA G1 | yes | expired | 2009-06-23 to 2022-06-25 | - | 0 | - | clean |
| 2 | countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA | yes | unknown | 2011-09-22 to 2030-09-22 | - | - | - | clean |
| 3 | countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis Code Signing ECC Root CA 2025 | yes | unknown | 2025-02-28 to 2050-02-22 | - | - | - | current errors: 1 |
| 4 | countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis Code Signing RSA Root CA 2025 | yes | unknown | 2025-02-28 to 2050-02-22 | - | - | - | clean |
| 5 | countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis SMIME ECC Root CA 2025 | yes | unknown | 2025-02-28 to 2050-02-22 | - | - | - | current errors: 1 |
| 6 | countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis SMIME RSA Root CA 2025 | yes | unknown | 2025-02-28 to 2050-02-22 | - | - | - | clean |
| 7 | countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis Time Stamping ECC Root CA 2025 | yes | unknown | 2025-02-28 to 2050-02-22 | - | - | - | current errors: 1 |
| 8 | countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis Time Stamping RSA Root CA 2025 | yes | unknown | 2025-02-28 to 2050-02-22 | - | - | - | clean |
| 9 | countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server ECC Root CA 2025 | yes | unknown | 2025-02-28 to 2050-02-22 | - | - | - | current errors: 1 |
| 10 | countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server RSA Root CA 2025 | yes | unknown | 2025-02-28 to 2050-02-22 | - | - | - | clean |
| 11 | countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication CA G2 | yes | revoked, expired | 2011-09-27 to 2023-09-27 | - | - | - | clean |
| 12 | countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication CA G2 | yes | revoked, expired | 2013-10-17 to 2023-10-17 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 13 | countryName=IT, stateOrProvinceName=Milano, localityName=Milano, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication CA G3 | yes | expired | 2014-02-13 to 2024-02-13 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 14 | countryName=IT, stateOrProvinceName=Milano, localityName=Milano, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Client Authentication CA G1 | yes | revoked | 2015-05-14 to 2030-05-14 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 15 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Client Authentication CA G2 | yes | revoked | 2019-09-20 to 2030-09-22 | 2.5.29.32.0 | - | TLS Web Client Authentication, E-mail Protection, OCSP Signing | historical errors: 1 |
| 16 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Client Authentication CA G3 | yes | current | 2020-07-06 to 2030-09-22 | 2.5.29.32.0 | - | TLS Web Client Authentication, E-mail Protection | clean |
| 17 | Actalis Code Signing CA G1 | no | revoked | 2019-03-21 to 2030-09-22 | - | - | - | not_available |
| 18 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Code Signing CA G2 | yes | current | 2020-07-06 to 2030-09-22 | 2.5.29.32.0 | - | Code Signing | clean |
| 19 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Code Signing ECC CA 2025 | yes | current | 2025-07-07 to 2035-07-05 | 2.5.29.32.0 | - | Code Signing | clean |
| 20 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Code Signing RSA CA 2025 | yes | current | 2025-07-07 to 2035-07-05 | 2.5.29.32.0 | - | Code Signing | clean |
| 21 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Domain Validated TLS Server ECC CA 2025 | yes | current | 2025-07-07 to 2035-07-05 | 2.5.29.32.0 | - | TLS Web Server Authentication | current errors: 1 |
| 22 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Domain Validated TLS Server RSA CA 2025 | yes | current | 2025-07-07 to 2035-07-05 | 2.5.29.32.0 | - | TLS Web Server Authentication | clean |
| 23 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Domain Validation Server CA G1 | yes | revoked | 2019-03-12 to 2030-09-22 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 24 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Domain Validation Server CA G1 | yes | revoked | 2016-10-06 to 2030-09-22 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 25 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Domain Validation Server CA G2 | yes | revoked | 2019-03-19 to 2030-09-22 | 2.5.29.32.0 | - | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 2 |
| 26 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Domain Validation Server CA G3 | yes | current | 2020-07-06 to 2030-09-22 | 2.5.29.32.0 | - | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 27 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis DV Server ACME CA G1 | yes | current | 2023-06-26 to 2030-09-22 | 2.5.29.32.0 | - | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 28 | countryName=IT, stateOrProvinceName=Milano, localityName=Milano, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Extended Validation Server CA G1 | yes | revoked | 2015-05-14 to 2030-05-14 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 29 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Extended Validation Server CA G2 | yes | revoked | 2019-03-13 to 2030-09-22 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 30 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Extended Validation Server CA G2 | yes | revoked | 2019-03-19 to 2030-09-22 | 2.5.29.32.0 | - | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 2 |
| 31 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Extended Validation Server CA G3 | yes | current | 2020-07-06 to 2030-09-22 | 2.5.29.32.0 | - | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 32 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Extended Validation TLS Server ECC CA 2025 | yes | current | 2025-07-07 to 2035-07-05 | 2.5.29.32.0 | - | TLS Web Server Authentication | current errors: 1 |
| 33 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Extended Validation TLS Server RSA CA 2025 | yes | current | 2025-07-07 to 2035-07-05 | 2.5.29.32.0 | - | TLS Web Server Authentication | clean |
| 34 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Organization Validated Server CA G1 | yes | revoked | 2018-01-17 to 2030-09-22 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 35 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Organization Validated Server CA G2 | yes | revoked | 2019-03-21 to 2030-09-22 | 2.5.29.32.0 | - | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 2 |
| 36 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Organization Validated Server CA G3 | yes | current | 2020-07-06 to 2030-09-22 | 2.5.29.32.0 | - | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 37 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Organization Validated TLS Server ECC CA 2025 | yes | current | 2025-07-07 to 2035-07-05 | 2.5.29.32.0 | - | TLS Web Server Authentication | current errors: 1 |
| 38 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Organization Validated TLS Server RSA CA 2025 | yes | current | 2025-07-07 to 2035-07-05 | 2.5.29.32.0 | - | TLS Web Server Authentication | clean |
| 39 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis SMIME ECC CA 2025 | yes | current | 2025-07-07 to 2035-07-05 | 2.5.29.32.0 | - | TLS Web Client Authentication, E-mail Protection | clean |
| 40 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis SMIME RSA CA 2025 | yes | current | 2025-07-07 to 2035-07-05 | 2.5.29.32.0 | - | TLS Web Client Authentication, E-mail Protection | clean |
| 41 | countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis SMIME RSA Root CA 2025 | yes | current | 2025-08-07 to 2030-09-22 | 2.5.29.32.0 | - | TLS Web Client Authentication, E-mail Protection | clean |
| 42 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Time Stamping CA G1 | yes | current | 2023-03-10 to 2030-09-22 | 2.23.140.1.4.2 | - | Time Stamping | clean |
| 43 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Time Stamping ECC CA 2025 | yes | current | 2025-10-02 to 2040-09-28 | 2.5.29.32.0 | - | Time Stamping | clean |
| 44 | countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Time Stamping RSA CA 2025 | yes | current | 2025-10-02 to 2040-09-28 | 2.5.29.32.0 | - | Time Stamping | clean |
| 45 | countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server ECC Root CA 2025 | yes | revoked | 2025-07-30 to 2030-09-22 | 2.5.29.32.0 | - | Any Extended Key Usage | historical errors: 1 |
| 46 | countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server ECC Root CA 2025 | yes | current | 2025-08-07 to 2030-09-22 | 2.5.29.32.0 | - | TLS Web Server Authentication | current errors: 1 |
| 47 | countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server RSA Root CA 2025 | yes | revoked | 2025-07-30 to 2030-09-22 | 2.5.29.32.0 | - | Any Extended Key Usage | clean |
| 48 | countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server RSA Root CA 2025 | yes | current | 2025-08-07 to 2030-09-22 | 2.5.29.32.0 | - | TLS Web Server Authentication | clean |
| 49 | countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA SSL SERVER | yes | current | 2021-11-24 to 2030-09-22 | 1.3.76.16.3.1 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 50 | countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1 | yes | revoked | 2018-04-04 to 2028-04-03 | 1.3.76.16.3.1 | 0 | TLS Web Server Authentication, E-mail Protection | historical errors: 3 |
| 51 | countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1 | yes | revoked | 2021-09-21 to 2030-09-22 | 1.3.76.16.3.1 | 0 | TLS Web Client Authentication, E-mail Protection | historical errors: 1 |
| 52 | countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, commonName=AgID CA1 | yes | revoked | 2025-01-21 to 2030-09-22 | 1.3.76.16.3.1 | 0 | TLS Web Client Authentication, E-mail Protection | historical errors: 1 |
| 53 | countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1 | yes | revoked | 2020-01-30 to 2030-01-29 | 1.3.76.16.3.1 | 0 | TLS Web Server Authentication, E-mail Protection | historical errors: 3 |
| 54 | countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1 | yes | revoked | 2019-06-13 to 2029-06-12 | 1.3.76.16.3.1 | 0 | TLS Web Server Authentication, E-mail Protection | historical errors: 3 |
| 55 | countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1 | yes | revoked | 2019-04-15 to 2029-04-14 | 1.3.76.16.3.1 | 0 | TLS Web Server Authentication, E-mail Protection | historical errors: 3 |
| 56 | countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1 | yes | revoked | 2020-02-19 to 2030-02-18 | 1.3.76.16.3.1 | 0 | TLS Web Client Authentication, E-mail Protection, TLS Web Server Authentication | historical errors: 3 |
| 57 | countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1 | yes | revoked | 2020-10-13 to 2030-09-22 | 1.3.76.16.3.1 | 0 | TLS Web Client Authentication, E-mail Protection, TLS Web Server Authentication | historical errors: 4 |
| 58 | countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1 | yes | current | 2025-02-20 to 2030-09-22 | 1.3.76.16.3.1 | 0 | TLS Web Client Authentication, E-mail Protection | current errors: 1 |
| 59 | countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1 | yes | revoked | 2023-12-13 to 2030-09-22 | 1.3.76.16.3.1 | 0 | TLS Web Client Authentication, E-mail Protection | historical errors: 1 |
| 60 | countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1 | yes | revoked | 2018-11-22 to 2028-11-21 | 1.3.76.16.3.1 | 0 | TLS Web Server Authentication, E-mail Protection | historical errors: 3 |
| 61 | countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1 | yes | revoked | 2018-07-11 to 2028-07-10 | 1.3.76.16.3.1 | 0 | TLS Web Server Authentication, E-mail Protection | historical errors: 3 |
| 62 | countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1 | yes | revoked | 2018-06-20 to 2028-06-19 | 1.3.76.16.3.1 | 0 | TLS Web Server Authentication, E-mail Protection | historical errors: 3 |
| 63 | countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1 | yes | revoked | 2017-10-12 to 2027-10-12 | 1.3.76.16.3.1 | 0 | TLS Web Server Authentication, E-mail Protection | historical errors: 3 |

## Certificate Details

### Actalis Authentication CA G1

- Subject: countryName=IT, localityName=Milano, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication CA G1
- Issuer: countryName=IT, localityName=Milano, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication CA G1
- Serial: 01
- SHA-256: AFE80A97EA11159190E927E08EC2E60C59A40559483A3FEE838A85321B3AEAAD
- SPKI SHA-256: 112432E4BB848C45549FCBF0C710C566D0082BBBC4E9B38E6C76AD46448128FC
- Validity: 2009-06-23 to 2022-06-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: http://www.actalis.it/documenti-en/actalisca_audit_statement.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Disabled","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = IT, L = Milano, O = Actalis S.p.A./03358520967, CN = Actalis Authentication CA G1
        Validity
            Not Before: Jun 23 14:06:00 2009 GMT
            Not After : Jun 25 14:06:00 2022 GMT
        Subject: C = IT, L = Milano, O = Actalis S.p.A./03358520967, CN = Actalis Authentication CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                01:BB:D6:9B:56:B4:7E:E6:C5:58:DD:2C:98:F4:CA:72:F6:5F:33:86
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: AFE80A97EA11159190E927E08EC2E60C59A40559483A3FEE838A85321B3AEAAD
    SPKI SHA256: 112432E4BB848C45549FCBF0C710C566D0082BBBC4E9B38E6C76AD46448128FC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- is_expired

### Actalis Authentication Root CA

- Subject: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 570A119742C4E3CC
- SHA-256: 55926084EC963A64B96E2ABE01CE0BA86A64FBFEBCC7AAB5AFC155B37FD76066
- SPKI SHA-256: 25D4913CF587097414D29D26F6C1B1942CD6D64EAF45D0FCF81526ADBA96D324
- Validity: 2011-09-22 to 2030-09-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.actalis.com/cp-cps-code-signing-certificates; https://www.actalis.com/cp-cps-smime-certificates; https://www.actalis.com/cps-for-tsl-server-certificates
- CP/CPS same as parent: false
- Audit URLs: https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_Standard_Audit_v2_signedTS.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_TLS-BR_Audit_v2_signedTS.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_TLS-EV_Audit_v2_signedTS.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_SMIME-BR_Audit_v2_signedTS.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_CS-BR_Audit_v2_signedTS.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6271844772424770508 (0x570a119742c4e3cc)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Sep 22 11:22:02 2011 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 55926084EC963A64B96E2ABE01CE0BA86A64FBFEBCC7AAB5AFC155B37FD76066
    SPKI SHA256: 25D4913CF587097414D29D26F6C1B1942CD6D64EAF45D0FCF81526ADBA96D324
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Actalis Code Signing ECC Root CA 2025

- Subject: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis Code Signing ECC Root CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis Code Signing ECC Root CA 2025
- Serial: 60952498C70AA22B13F9589A4DB7B510
- SHA-256: 7EF55518DE6350C3CC618A9837CBAD65DDB6EEF652F79DA71C69F6B8919D3A12
- SPKI SHA-256: 676C942869539B12CCF7F33F793F20C00FEDE7A801B0E1666DCDDEE60ABA59E6
- Validity: 2025-02-28 to 2050-02-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.actalis.com/cp-cps-code-signing-certificates
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl13.actalis.it/Repository/codesign-root-ecc-2025/getLastCRL
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            60:95:24:98:c7:0a:a2:2b:13:f9:58:9a:4d:b7:b5:10
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis Code Signing ECC Root CA 2025
        Validity
            Not Before: Feb 28 09:35:22 2025 GMT
            Not After : Feb 22 09:35:21 2050 GMT
        Subject: C = IT, O = Actalis S.p.A., CN = Actalis Code Signing ECC Root CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                BD:91:46:D6:2D:85:18:18:4C:62:2B:1A:60:1C:88:A9:2E:3C:1B:C9
            X509v3 Subject Key Identifier:
                BD:91:46:D6:2D:85:18:18:4C:62:2B:1A:60:1C:88:A9:2E:3C:1B:C9
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 7EF55518DE6350C3CC618A9837CBAD65DDB6EEF652F79DA71C69F6B8919D3A12
    SPKI SHA256: 676C942869539B12CCF7F33F793F20C00FEDE7A801B0E1666DCDDEE60ABA59E6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Actalis Code Signing RSA Root CA 2025

- Subject: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis Code Signing RSA Root CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis Code Signing RSA Root CA 2025
- Serial: 2D8A53DF04A89F131396BCBBE02AE042
- SHA-256: 041C6215F8DF4137DF0F3FC23A0009B46E75AC4619F811727076BAA8FE5008C9
- SPKI SHA-256: B4FD92CA4F91161770D9099E281B9CB1A41A05A5A44F516A5E155461BDBCDAC9
- Validity: 2025-02-28 to 2050-02-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.actalis.com/cp-cps-code-signing-certificates
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl13.actalis.it/Repository/codesign-root-rsa-2025/getLastCRL
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2d:8a:53:df:04:a8:9f:13:13:96:bc:bb:e0:2a:e0:42
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis Code Signing RSA Root CA 2025
        Validity
            Not Before: Feb 28 09:15:30 2025 GMT
            Not After : Feb 22 09:15:29 2050 GMT
        Subject: C = IT, O = Actalis S.p.A., CN = Actalis Code Signing RSA Root CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                5D:55:AC:81:CA:47:C2:3A:D6:61:6E:FD:26:DF:1D:FE:B1:52:98:D8
            X509v3 Subject Key Identifier:
                5D:55:AC:81:CA:47:C2:3A:D6:61:6E:FD:26:DF:1D:FE:B1:52:98:D8
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 041C6215F8DF4137DF0F3FC23A0009B46E75AC4619F811727076BAA8FE5008C9
    SPKI SHA256: B4FD92CA4F91161770D9099E281B9CB1A41A05A5A44F516A5E155461BDBCDAC9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Actalis SMIME ECC Root CA 2025

- Subject: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis SMIME ECC Root CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis SMIME ECC Root CA 2025
- Serial: 54939BA77DB2818B045FE1E9303CEDEE
- SHA-256: 3347EEA8149CD3F6B7796CCAAD234ADA294372F7B1EA49F87F5ADB11C8581624
- SPKI SHA-256: 2FB67486570ADD6622A2F3E08E9BE8D9A018B3241A70D7C243168BBCEE174BF8
- Validity: 2025-02-28 to 2050-02-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.actalis.com/cp-cps-smime-certificates
- CP/CPS same as parent: false
- Audit URLs: https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_Standard_Audit_v2_signedTS.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_SMIME-BR_Audit_v2_signedTS.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl13.actalis.it/Repository/smime-root-ecc-2025/getLastCRL
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            54:93:9b:a7:7d:b2:81:8b:04:5f:e1:e9:30:3c:ed:ee
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis SMIME ECC Root CA 2025
        Validity
            Not Before: Feb 28 09:31:07 2025 GMT
            Not After : Feb 22 09:31:06 2050 GMT
        Subject: C = IT, O = Actalis S.p.A., CN = Actalis SMIME ECC Root CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                8D:6F:BC:F6:76:D1:CA:7D:86:DD:AB:D0:2A:96:99:C8:F1:63:B2:29
            X509v3 Subject Key Identifier:
                8D:6F:BC:F6:76:D1:CA:7D:86:DD:AB:D0:2A:96:99:C8:F1:63:B2:29
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 3347EEA8149CD3F6B7796CCAAD234ADA294372F7B1EA49F87F5ADB11C8581624
    SPKI SHA256: 2FB67486570ADD6622A2F3E08E9BE8D9A018B3241A70D7C243168BBCEE174BF8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Actalis SMIME RSA Root CA 2025

- Subject: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis SMIME RSA Root CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis SMIME RSA Root CA 2025
- Serial: 2F775A9E697DCF3A7FA2EAC3E133E0C3
- SHA-256: F1B7C8A8F447B395786E325AF0A7571203F3812400FF1905FCA7726B858FC44A
- SPKI SHA-256: 7E9653B325D0E74E82F2C53E71F71BAE85C56D8A58F67B366A3382A25EE1BC7F
- Validity: 2025-02-28 to 2050-02-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.actalis.com/cp-cps-smime-certificates
- CP/CPS same as parent: false
- Audit URLs: https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_Standard_Audit_v2_signedTS.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_SMIME-BR_Audit_v2_signedTS.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl13.actalis.it/Repository/smime-root-rsa-2025/getLastCRL
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2f:77:5a:9e:69:7d:cf:3a:7f:a2:ea:c3:e1:33:e0:c3
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis SMIME RSA Root CA 2025
        Validity
            Not Before: Feb 28 09:11:29 2025 GMT
            Not After : Feb 22 09:11:28 2050 GMT
        Subject: C = IT, O = Actalis S.p.A., CN = Actalis SMIME RSA Root CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                F3:EF:A2:39:AA:77:3B:C2:AD:6A:9F:FC:2E:58:00:FE:5B:BF:47:51
            X509v3 Subject Key Identifier:
                F3:EF:A2:39:AA:77:3B:C2:AD:6A:9F:FC:2E:58:00:FE:5B:BF:47:51
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: F1B7C8A8F447B395786E325AF0A7571203F3812400FF1905FCA7726B858FC44A
    SPKI SHA256: 7E9653B325D0E74E82F2C53E71F71BAE85C56D8A58F67B366A3382A25EE1BC7F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Actalis Time Stamping ECC Root CA 2025

- Subject: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis Time Stamping ECC Root CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis Time Stamping ECC Root CA 2025
- Serial: 7894FF81CC16C43ABC2467EE43139D13
- SHA-256: 5BB2824AA8D9068FD87E4713434B9EF543669DC95BA9080E7C9B6682333482FE
- SPKI SHA-256: F27388AF6AE7A68275C4304901BA771E8CF3C769AB29605FED83458E790087F5
- Validity: 2025-02-28 to 2050-02-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.actalis.com/cp-cps-code-signing-certificates
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl13.actalis.it/Repository/timestamp-root-ecc-2025/getLastCRL
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:94:ff:81:cc:16:c4:3a:bc:24:67:ee:43:13:9d:13
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis Time Stamping ECC Root CA 2025
        Validity
            Not Before: Feb 28 09:38:29 2025 GMT
            Not After : Feb 22 09:38:28 2050 GMT
        Subject: C = IT, O = Actalis S.p.A., CN = Actalis Time Stamping ECC Root CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                18:8C:2A:60:7B:02:CB:4A:40:9B:03:86:79:77:6E:74:AD:50:81:AE
            X509v3 Subject Key Identifier:
                18:8C:2A:60:7B:02:CB:4A:40:9B:03:86:79:77:6E:74:AD:50:81:AE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5BB2824AA8D9068FD87E4713434B9EF543669DC95BA9080E7C9B6682333482FE
    SPKI SHA256: F27388AF6AE7A68275C4304901BA771E8CF3C769AB29605FED83458E790087F5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Actalis Time Stamping RSA Root CA 2025

- Subject: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis Time Stamping RSA Root CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis Time Stamping RSA Root CA 2025
- Serial: 494B4E8A1BAA4A324EB10C36E6C75592
- SHA-256: C40621D2F61C51CE082A8697653D966441A52AAA6523482ED93F87A07EA8BF30
- SPKI SHA-256: 581424E905A6A0A31350A52A3BFE7AC81B82C9E6F4D10677F1D154CC19FB13B4
- Validity: 2025-02-28 to 2050-02-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.actalis.com/cp-cps-code-signing-certificates
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl13.actalis.it/Repository/timestamp-root-rsa-2025/getLastCRL
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            49:4b:4e:8a:1b:aa:4a:32:4e:b1:0c:36:e6:c7:55:92
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis Time Stamping RSA Root CA 2025
        Validity
            Not Before: Feb 28 09:19:30 2025 GMT
            Not After : Feb 22 09:19:29 2050 GMT
        Subject: C = IT, O = Actalis S.p.A., CN = Actalis Time Stamping RSA Root CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                E8:D3:0E:4D:B1:76:41:22:80:19:4D:50:48:84:F2:2F:35:90:9D:8E
            X509v3 Subject Key Identifier:
                E8:D3:0E:4D:B1:76:41:22:80:19:4D:50:48:84:F2:2F:35:90:9D:8E
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: C40621D2F61C51CE082A8697653D966441A52AAA6523482ED93F87A07EA8BF30
    SPKI SHA256: 581424E905A6A0A31350A52A3BFE7AC81B82C9E6F4D10677F1D154CC19FB13B4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Actalis TLS Server ECC Root CA 2025

- Subject: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server ECC Root CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server ECC Root CA 2025
- Serial: 3B1F6D5F9D28D851CA41F36F98EA56D1
- SHA-256: 4EFAADA2543E1E02666998574B3BAD96AE264088FA5917F75D32E7A609D1869C
- SPKI SHA-256: CCA4EB68C98622E2264879B61562EAD139559C91FE6B6AB3081EB19631426855
- Validity: 2025-02-28 to 2050-02-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.actalis.com/cps-for-tsl-server-certificates
- CP/CPS same as parent: false
- Audit URLs: https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_Standard_Audit_v2_signedTS.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_TLS-BR_Audit_v2_signedTS.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_TLS-EV_Audit_v2_signedTS.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl13.actalis.it/Repository/tls-root-ecc-2025/getLastCRL
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3b:1f:6d:5f:9d:28:d8:51:ca:41:f3:6f:98:ea:56:d1
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis TLS Server ECC Root CA 2025
        Validity
            Not Before: Feb 28 09:27:28 2025 GMT
            Not After : Feb 22 09:27:27 2050 GMT
        Subject: C = IT, O = Actalis S.p.A., CN = Actalis TLS Server ECC Root CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                30:22:BD:D5:9A:B5:D2:87:2F:FF:A6:7C:A3:B5:4C:16:57:F0:AE:0C
            X509v3 Subject Key Identifier:
                30:22:BD:D5:9A:B5:D2:87:2F:FF:A6:7C:A3:B5:4C:16:57:F0:AE:0C
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4EFAADA2543E1E02666998574B3BAD96AE264088FA5917F75D32E7A609D1869C
    SPKI SHA256: CCA4EB68C98622E2264879B61562EAD139559C91FE6B6AB3081EB19631426855
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Actalis TLS Server RSA Root CA 2025

- Subject: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server RSA Root CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server RSA Root CA 2025
- Serial: 4FD71E2003B285BC62A5111F929D1708
- SHA-256: 6D0E47DFDE7CF48308CD4C6C1517DD1AF033DCC72BB0501C04268B03B58A9085
- SPKI SHA-256: 8F94CEDD9A5C168BE13D0511F67E92664E89876224CEF12F7FCEB91A67F8E6F0
- Validity: 2025-02-28 to 2050-02-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.actalis.com/cps-for-tsl-server-certificates
- CP/CPS same as parent: false
- Audit URLs: https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_Standard_Audit_v2_signedTS.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_TLS-BR_Audit_v2_signedTS.pdf, https://pceb.tayllorcox.cz/files/2026_Actalis_AAL_TLS-EV_Audit_v2_signedTS.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl13.actalis.it/Repository/tls-root-rsa-2025/getLastCRL
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4f:d7:1e:20:03:b2:85:bc:62:a5:11:1f:92:9d:17:08
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis TLS Server RSA Root CA 2025
        Validity
            Not Before: Feb 28 09:03:47 2025 GMT
            Not After : Feb 22 09:03:46 2050 GMT
        Subject: C = IT, O = Actalis S.p.A., CN = Actalis TLS Server RSA Root CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                AF:53:50:61:72:E9:72:04:31:41:DB:0E:66:CF:75:3A:F6:0E:BF:CF
            X509v3 Subject Key Identifier:
                AF:53:50:61:72:E9:72:04:31:41:DB:0E:66:CF:75:3A:F6:0E:BF:CF
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 6D0E47DFDE7CF48308CD4C6C1517DD1AF033DCC72BB0501C04268B03B58A9085
    SPKI SHA256: 8F94CEDD9A5C168BE13D0511F67E92664E89876224CEF12F7FCEB91A67F8E6F0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Actalis Authentication CA G2

- Subject: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication CA G2
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 39F24122117001D4
- SHA-256: 92D76D3216B54FE8B251C1216A5DA4B7C788D88E83663A0792D69EF34680F776
- SPKI SHA-256: 5CCBB9843E48A700F6417C9031750E5DAD63C453E9D2885A6B446CB7EC061BB7
- Validity: 2011-09-27 to 2023-09-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: ldap://ldap.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://portal.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4175471419103117780 (0x39f24122117001d4)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Sep 27 13:11:47 2011 GMT
            Not After : Sep 27 13:11:47 2023 GMT
        Subject: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                DD:44:8A:40:B7:EE:F4:CB:0C:BD:D3:5D:A7:00:28:E0:F3:31:46:A9
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://portal.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 92D76D3216B54FE8B251C1216A5DA4B7C788D88E83663A0792D69EF34680F776
    SPKI SHA256: 5CCBB9843E48A700F6417C9031750E5DAD63C453E9D2885A6B446CB7EC061BB7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://portal.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- is_expired

### Actalis Authentication CA G2

- Subject: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication CA G2
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 589DAA1F3594A939
- SHA-256: DAC7DA26662D6E3BE0423F8639623C6D5A3B3F3E09E38B44DACCD02972300D24
- SPKI SHA-256: 5CCBB9843E48A700F6417C9031750E5DAD63C453E9D2885A6B446CB7EC061BB7
- Validity: 2013-10-17 to 2023-10-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://portal.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://portal.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6385446897700874553 (0x589daa1f3594a939)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Oct 17 09:40:40 2013 GMT
            Not After : Oct 17 09:40:40 2023 GMT
        Subject: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://portal.actalis.it/VA/AUTH-ROOT
            X509v3 Subject Key Identifier:
                DD:44:8A:40:B7:EE:F4:CB:0C:BD:D3:5D:A7:00:28:E0:F3:31:46:A9
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://portal.actalis.it/Repository/Policy/SSL/CPS
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://portal.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DAC7DA26662D6E3BE0423F8639623C6D5A3B3F3E09E38B44DACCD02972300D24
    SPKI SHA256: 5CCBB9843E48A700F6417C9031750E5DAD63C453E9D2885A6B446CB7EC061BB7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://portal.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://portal.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### Actalis Authentication CA G3

- Subject: countryName=IT, stateOrProvinceName=Milano, localityName=Milano, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication CA G3
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 741D584A72FC06BC
- SHA-256: A1D25D28941FAFC0C2A6EB9E596A54786E731D0A4A8E321DB9F1CF2C24FDD609
- SPKI SHA-256: AAA15894A735946B4F643577F92D888AAEE892DF9F0F9B560B600CD501019848
- Validity: 2014-02-13 to 2024-02-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl03.actalis.it/Repository/AUTH-G3/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://portal.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://portal.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 8366940759504193212 (0x741d584a72fc06bc)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Feb 13 15:02:23 2014 GMT
            Not After : Feb 13 15:02:23 2024 GMT
        Subject: C = IT, ST = Milano, L = Milano, O = Actalis S.p.A./03358520967, CN = Actalis Authentication CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://portal.actalis.it/VA/AUTH-ROOT
            X509v3 Subject Key Identifier:
                AA:AA:FD:CA:8C:1D:4D:F1:2E:83:E1:06:FC:FA:8E:EA:0E:23:AE:3D
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://portal.actalis.it/Repository/Policy/SSL/CPS
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://portal.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A1D25D28941FAFC0C2A6EB9E596A54786E731D0A4A8E321DB9F1CF2C24FDD609
    SPKI SHA256: AAA15894A735946B4F643577F92D888AAEE892DF9F0F9B560B600CD501019848
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://portal.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://portal.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### Actalis Client Authentication CA G1

- Subject: countryName=IT, stateOrProvinceName=Milano, localityName=Milano, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Client Authentication CA G1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 2CD48AD3B11E0F89
- SHA-256: ABDEEC53149098F8A0B07EFD972B345A89BEDE8EDE6975E61BE95EE026DA7EFA
- SPKI SHA-256: 62CA86F3BBA0AFB8884D134515A1DE357E6832663CD0994456EA810B10216403
- Validity: 2015-05-14 to 2030-05-14
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl05.actalis.it/Repository/AUTHCL-G1/getLastCRL
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3230359474545758089 (0x2cd48ad3b11e0f89)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: May 14 07:14:15 2015 GMT
            Not After : May 14 07:14:15 2030 GMT
        Subject: C = IT, ST = Milano, L = Milano, O = Actalis S.p.A./03358520967, CN = Actalis Client Authentication CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Subject Key Identifier:
                7E:60:FC:F8:6C:A7:3D:3D:D7:AE:93:A1:79:02:8F:B3:74:29:3B:F5
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.it/area-download
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: ABDEEC53149098F8A0B07EFD972B345A89BEDE8EDE6975E61BE95EE026DA7EFA
    SPKI SHA256: 62CA86F3BBA0AFB8884D134515A1DE357E6832663CD0994456EA810B10216403
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Actalis Client Authentication CA G2

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Client Authentication CA G2
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 4FDE104BED955BDE8BAD6587CC415EE3
- SHA-256: 54450B278052FA91911600CB98F3100A0FB581528D8FEAB98B6FFEF8A48C998E
- SPKI SHA-256: EBE594DBD7F3731C42AFBA6859450B6680F141BEE9279A898677B44B8EA959BE
- Validity: 2019-09-20 to 2030-09-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4f:de:10:4b:ed:95:5b:de:8b:ad:65:87:cc:41:5e:e3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Sep 20 07:12:05 2019 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A./03358520967, CN = Actalis Client Authentication CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.it/area-download
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                6B:F2:8D:9E:68:C1:25:04:1F:51:34:57:F6:16:5C:94:EA:4D:69:1A
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 54450B278052FA91911600CB98F3100A0FB581528D8FEAB98B6FFEF8A48C998E
    SPKI SHA256: EBE594DBD7F3731C42AFBA6859450B6680F141BEE9279A898677B44B8EA959BE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Actalis Client Authentication CA G3

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Client Authentication CA G3
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 17103EDE3D8A1CB5CA065193E7CA436B
- SHA-256: BB4D3EE661E5029409DB6740B9951494A7F22A7BC0FDC1A1900C07A4781F1419
- SPKI SHA-256: DABED3304517384A5A6FF5C02591007EFAC235E159E1D279D241F1AE9EAB1D1B
- Validity: 2020-07-06 to 2030-09-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl09.actalis.it/Repository/AUTHCL-G3/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            17:10:3e:de:3d:8a:1c:b5:ca:06:51:93:e7:ca:43:6b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Jul  6 08:45:47 2020 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis Client Authentication CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.it/area-download
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                BE:97:A9:AA:84:BF:80:BF:10:53:7D:09:32:F9:E1:2E:32:1B:CF:77
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BB4D3EE661E5029409DB6740B9951494A7F22A7BC0FDC1A1900C07A4781F1419
    SPKI SHA256: DABED3304517384A5A6FF5C02591007EFAC235E159E1D279D241F1AE9EAB1D1B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Actalis Code Signing CA G1

- Subject: Actalis Code Signing CA G1
- Issuer: Actalis Authentication Root CA
- Serial: -
- SHA-256: 28361D057C49D023952FD459D39C2EB8FE497AA8B57D0FDF4820A6CF009768CF
- SPKI SHA-256: -
- Validity: 2019-03-21 to 2030-09-22
- Key: unknown
- Signature Algorithm: -

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl09.actalis.it/Repository/AUTHCS-G1/getLastCRL
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: false
- pathLen: -
- Key Usage: -
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
No parsed certificate text available.
```

#### Extensions

- Basic Constraints: {"present":false,"critical":false,"ca":false,"path_len":null}
- Key Usage: -
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- not_available

#### Computed Flags

- is_subordinate_ca

### Actalis Code Signing CA G2

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Code Signing CA G2
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 33ACC104460C5CA57E1355819BDF93D9
- SHA-256: 8CC827CEA1CD8DB79AEB7CD4BEEAE36658AF7B4C0606C257B7538AB1E710BC6A
- SPKI SHA-256: 525CC0E6AA10EC88C75BC45847F822CA10A7984A3B2F52EDE1D6BB7F43DD9353
- Validity: 2020-07-06 to 2030-09-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl09.actalis.it/Repository/AUTHCS-G2/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:ac:c1:04:46:0c:5c:a5:7e:13:55:81:9b:df:93:d9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Jul  6 08:09:02 2020 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis Code Signing CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.it/area-download
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                78:07:05:52:0B:A3:D8:C8:4B:41:3D:4F:CF:38:63:06:78:F0:A7:F3
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8CC827CEA1CD8DB79AEB7CD4BEEAE36658AF7B4C0606C257B7538AB1E710BC6A
    SPKI SHA256: 525CC0E6AA10EC88C75BC45847F822CA10A7984A3B2F52EDE1D6BB7F43DD9353
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Actalis Code Signing ECC CA 2025

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Code Signing ECC CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis Code Signing ECC Root CA 2025
- Serial: 0AFBA5FAB5825F6CF3AFA5DFAE81FFEF
- SHA-256: CD8C8EF741D98764015145EDB8F513B97EFEA3178B676AB8AED7343C0A5B949C
- SPKI SHA-256: F471124FB603D2BCEE508B11D6D6AC28944C95547226DAF5F95B93170A6BA2E3
- Validity: 2025-07-07 to 2035-07-05
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl15.actalis.it/Repository/codesign-subca-ecc-2025/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp13.actalis.it/va/codesign-root-ecc-2025
- CRL DP: http://crl13.actalis.it/Repository/codesign-root-ecc-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0a:fb:a5:fa:b5:82:5f:6c:f3:af:a5:df:ae:81:ff:ef
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis Code Signing ECC Root CA 2025
        Validity
            Not Before: Jul  7 15:26:38 2025 GMT
            Not After : Jul  5 15:26:37 2035 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis Code Signing ECC CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                BD:91:46:D6:2D:85:18:18:4C:62:2B:1A:60:1C:88:A9:2E:3C:1B:C9
            Authority Information Access:
                CA Issuers - URI:http://cacert.actalis.it/certs/codesign-root-ecc-2025
                OCSP - URI:http://ocsp13.actalis.it/va/codesign-root-ecc-2025
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.com/legal-repository
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl13.actalis.it/Repository/codesign-root-ecc-2025/getLastCRL
            X509v3 Subject Key Identifier:
                C4:60:04:7E:1A:86:78:74:AE:BB:48:8E:2B:C5:B2:B7:46:8F:D9:3A
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: CD8C8EF741D98764015145EDB8F513B97EFEA3178B676AB8AED7343C0A5B949C
    SPKI SHA256: F471124FB603D2BCEE508B11D6D6AC28944C95547226DAF5F95B93170A6BA2E3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp13.actalis.it/va/codesign-root-ecc-2025
- AIA CA Issuers: http://cacert.actalis.it/certs/codesign-root-ecc-2025
- CRL Distribution Points: http://crl13.actalis.it/Repository/codesign-root-ecc-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Actalis Code Signing RSA CA 2025

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Code Signing RSA CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis Code Signing RSA Root CA 2025
- Serial: 64394A2531FF65E38F61F25A7EDF0242
- SHA-256: C0BAB1DFA43BE4AF018D20AE437A0C312050353DDD6533D1CFB426D1B3E00596
- SPKI SHA-256: 753EF98680EDE678FD1961BDD080B9A91ACFDB170080352F7B6CDD0057164E68
- Validity: 2025-07-07 to 2035-07-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl15.actalis.it/Repository/codesign-subca-rsa-2025/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp13.actalis.it/va/codesign-root-rsa-2025
- CRL DP: http://crl13.actalis.it/Repository/codesign-root-rsa-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            64:39:4a:25:31:ff:65:e3:8f:61:f2:5a:7e:df:02:42
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis Code Signing RSA Root CA 2025
        Validity
            Not Before: Jul  7 15:18:11 2025 GMT
            Not After : Jul  5 15:18:10 2035 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis Code Signing RSA CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                5D:55:AC:81:CA:47:C2:3A:D6:61:6E:FD:26:DF:1D:FE:B1:52:98:D8
            Authority Information Access:
                CA Issuers - URI:http://cacert.actalis.it/certs/codesign-root-rsa-2025
                OCSP - URI:http://ocsp13.actalis.it/va/codesign-root-rsa-2025
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.com/legal-repository
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl13.actalis.it/Repository/codesign-root-rsa-2025/getLastCRL
            X509v3 Subject Key Identifier:
                45:59:B5:FC:43:69:25:60:3D:B5:37:36:B4:1A:AA:5D:CB:FA:31:F4
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: C0BAB1DFA43BE4AF018D20AE437A0C312050353DDD6533D1CFB426D1B3E00596
    SPKI SHA256: 753EF98680EDE678FD1961BDD080B9A91ACFDB170080352F7B6CDD0057164E68
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp13.actalis.it/va/codesign-root-rsa-2025
- AIA CA Issuers: http://cacert.actalis.it/certs/codesign-root-rsa-2025
- CRL Distribution Points: http://crl13.actalis.it/Repository/codesign-root-rsa-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Actalis Domain Validated TLS Server ECC CA 2025

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Domain Validated TLS Server ECC CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server ECC Root CA 2025
- Serial: 7FA8268C4D449BF501861FBF572A77A7
- SHA-256: E102A52A016B025B31C749A9A0A7F4650E1227AFA27C27E9A37C846AD42FA8B0
- SPKI SHA-256: 8C407526581B7E234E7FC5351EDDFB30A49023B481B2DE00A797D77BF17BB70D
- Validity: 2025-07-07 to 2035-07-05
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl15.actalis.it/Repository/tls-subca-ecc-dv-2025/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp13.actalis.it/va/tls-root-ecc-2025
- CRL DP: http://crl13.actalis.it/Repository/tls-root-ecc-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:a8:26:8c:4d:44:9b:f5:01:86:1f:bf:57:2a:77:a7
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis TLS Server ECC Root CA 2025
        Validity
            Not Before: Jul  7 09:52:12 2025 GMT
            Not After : Jul  5 09:52:11 2035 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis Domain Validated TLS Server ECC CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                30:22:BD:D5:9A:B5:D2:87:2F:FF:A6:7C:A3:B5:4C:16:57:F0:AE:0C
            Authority Information Access:
                CA Issuers - URI:http://cacert.actalis.it/certs/tls-root-ecc-2025
                OCSP - URI:http://ocsp13.actalis.it/va/tls-root-ecc-2025
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.com/legal-repository
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl13.actalis.it/Repository/tls-root-ecc-2025/getLastCRL
            X509v3 Subject Key Identifier:
                3F:2B:EA:35:9C:76:59:0C:CD:91:7A:3E:2F:74:E5:3A:90:73:97:E0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E102A52A016B025B31C749A9A0A7F4650E1227AFA27C27E9A37C846AD42FA8B0
    SPKI SHA256: 8C407526581B7E234E7FC5351EDDFB30A49023B481B2DE00A797D77BF17BB70D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp13.actalis.it/va/tls-root-ecc-2025
- AIA CA Issuers: http://cacert.actalis.it/certs/tls-root-ecc-2025
- CRL Distribution Points: http://crl13.actalis.it/Repository/tls-root-ecc-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Actalis Domain Validated TLS Server RSA CA 2025

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Domain Validated TLS Server RSA CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server RSA Root CA 2025
- Serial: 440E10626D31DB911F1CF5A145E00367
- SHA-256: C511EF2F15EF7681EEADFF97F1E90596270EADB71BDA8F847AB36FFF15DC6264
- SPKI SHA-256: 89BBD4ADC27BBBFD693E1A55B566B8A16C576A3411B116FFD1EDF7671F0D1E60
- Validity: 2025-07-07 to 2035-07-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl15.actalis.it/Repository/tls-subca-rsa-dv-2025/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp13.actalis.it/va/tls-root-rsa-2025
- CRL DP: http://crl13.actalis.it/Repository/tls-root-rsa-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            44:0e:10:62:6d:31:db:91:1f:1c:f5:a1:45:e0:03:67
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis TLS Server RSA Root CA 2025
        Validity
            Not Before: Jul  7 12:59:33 2025 GMT
            Not After : Jul  5 12:59:32 2035 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis Domain Validated TLS Server RSA CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                AF:53:50:61:72:E9:72:04:31:41:DB:0E:66:CF:75:3A:F6:0E:BF:CF
            Authority Information Access:
                CA Issuers - URI:http://cacert.actalis.it/certs/tls-root-rsa-2025
                OCSP - URI:http://ocsp13.actalis.it/va/tls-root-rsa-2025
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.com/legal-repository
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl13.actalis.it/Repository/tls-root-rsa-2025/getLastCRL
            X509v3 Subject Key Identifier:
                D8:BA:CF:A1:9E:80:0E:0A:A6:32:7E:5E:FB:FB:75:D0:8E:62:B4:5E
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: C511EF2F15EF7681EEADFF97F1E90596270EADB71BDA8F847AB36FFF15DC6264
    SPKI SHA256: 89BBD4ADC27BBBFD693E1A55B566B8A16C576A3411B116FFD1EDF7671F0D1E60
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp13.actalis.it/va/tls-root-rsa-2025
- AIA CA Issuers: http://cacert.actalis.it/certs/tls-root-rsa-2025
- CRL Distribution Points: http://crl13.actalis.it/Repository/tls-root-rsa-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Actalis Domain Validation Server CA G1

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Domain Validation Server CA G1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 14D5111E8EB9A8ECAA7F5BE9D9E03A0E
- SHA-256: 072BEDBCF4D334598E341D72ABCF14CDD8C3F9A7310E0157FC0375239DE018AB
- SPKI SHA-256: 049244A9673220E68E22FF22FB3C01C226E7AB6F7FDCCD230808CBE151B76EF5
- Validity: 2019-03-12 to 2030-09-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            14:d5:11:1e:8e:b9:a8:ec:aa:7f:5b:e9:d9:e0:3a:0e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Mar 12 09:29:48 2019 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A./03358520967, CN = Actalis Domain Validation Server CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Subject Key Identifier:
                1B:42:7F:5C:45:7E:FF:7E:1E:1E:41:9C:F3:AD:AE:35:C6:65:EB:C5
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.it/area-download
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 072BEDBCF4D334598E341D72ABCF14CDD8C3F9A7310E0157FC0375239DE018AB
    SPKI SHA256: 049244A9673220E68E22FF22FB3C01C226E7AB6F7FDCCD230808CBE151B76EF5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Actalis Domain Validation Server CA G1

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Domain Validation Server CA G1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 5B49DA1E2770E2BA
- SHA-256: FD98B40EB94AAC097622179F1E3ACDDACD3F3C9527CD6974DC3614D09AD37AAE
- SPKI SHA-256: 049244A9673220E68E22FF22FB3C01C226E7AB6F7FDCCD230808CBE151B76EF5
- Validity: 2016-10-06 to 2030-09-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl06.actalis.it/Repository/AUTHDV-G1/getLastCRL
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6578028553796903610 (0x5b49da1e2770e2ba)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Oct  6 07:55:29 2016 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A./03358520967, CN = Actalis Domain Validation Server CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Subject Key Identifier:
                1B:42:7F:5C:45:7E:FF:7E:1E:1E:41:9C:F3:AD:AE:35:C6:65:EB:C5
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.it/area-download
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FD98B40EB94AAC097622179F1E3ACDDACD3F3C9527CD6974DC3614D09AD37AAE
    SPKI SHA256: 049244A9673220E68E22FF22FB3C01C226E7AB6F7FDCCD230808CBE151B76EF5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Actalis Domain Validation Server CA G2

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Domain Validation Server CA G2
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 45E78CA5F5FBD35E0A6C1733F818BB54
- SHA-256: D7A06D462AFC80D71183D94A398B2DCC825835E7C66DA5E45405572F04B05A5D
- SPKI SHA-256: 32678D1D10EE0C7CB1D2F35F3E45746414EE3B949C9CE323C3602436FD45B347
- Validity: 2019-03-19 to 2030-09-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:e7:8c:a5:f5:fb:d3:5e:0a:6c:17:33:f8:18:bb:54
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Mar 19 08:05:01 2019 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A./03358520967, CN = Actalis Domain Validation Server CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Subject Key Identifier:
                D5:40:08:F7:96:22:4E:19:B3:DA:E5:61:93:BA:BA:B7:3E:EB:B9:CD
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.it/area-download
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D7A06D462AFC80D71183D94A398B2DCC825835E7C66DA5E45405572F04B05A5D
    SPKI SHA256: 32678D1D10EE0C7CB1D2F35F3E45746414EE3B949C9CE323C3602436FD45B347
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Actalis Domain Validation Server CA G3

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Domain Validation Server CA G3
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 12737797A315886DFEB76C7E6A5A0354
- SHA-256: 3450B6D38290C3CA5D7BB38B71495BBF72C6D0C44DBA292245F9BCA9843A9FFF
- SPKI SHA-256: 862CA35AA9E46000D80B4CB13706C3E4C022D3550D599439BF6BEC0DDD2CF54A
- Validity: 2020-07-06 to 2030-09-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl06.actalis.it/Repository/AUTHDV-G3/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            12:73:77:97:a3:15:88:6d:fe:b7:6c:7e:6a:5a:03:54
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Jul  6 06:36:50 2020 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis Domain Validation Server CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.it/area-download
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                42:83:6D:80:7C:09:84:67:FD:80:57:AB:F1:26:F5:77:C8:22:82:71
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3450B6D38290C3CA5D7BB38B71495BBF72C6D0C44DBA292245F9BCA9843A9FFF
    SPKI SHA256: 862CA35AA9E46000D80B4CB13706C3E4C022D3550D599439BF6BEC0DDD2CF54A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Actalis DV Server ACME CA G1

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis DV Server ACME CA G1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 287BCABA4F75D91BFA05BB1D74F3DD90
- SHA-256: C0A9FB425D0EDEBC72BC6C47AD3D3A2B68245ED1D59A5883BF19CE9F8C4DED1F
- SPKI SHA-256: 574727E0F3296CFE4A832DD802D45834F69BF6C1A4D5B4CAB527DBF1CDF2F786
- Validity: 2023-06-26 to 2030-09-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl14.actalis.it/Repository/AUTHACMEDV-G1/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            28:7b:ca:ba:4f:75:d9:1b:fa:05:bb:1d:74:f3:dd:90
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Jun 26 14:32:33 2023 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis DV Server ACME CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                CA Issuers - URI:http://cacert.actalis.it/certs/actalis-autroot
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.it/area-download
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                51:9A:91:1F:D2:57:39:17:D9:B7:E2:26:83:BD:7B:B4:B5:3F:38:8A
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C0A9FB425D0EDEBC72BC6C47AD3D3A2B68245ED1D59A5883BF19CE9F8C4DED1F
    SPKI SHA256: 574727E0F3296CFE4A832DD802D45834F69BF6C1A4D5B4CAB527DBF1CDF2F786
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: http://cacert.actalis.it/certs/actalis-autroot
- CRL Distribution Points: http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Actalis Extended Validation Server CA G1

- Subject: countryName=IT, stateOrProvinceName=Milano, localityName=Milano, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Extended Validation Server CA G1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 32D62BFC67501ACB
- SHA-256: 4942AD0441218AEC22DAC417AC499D7DE4C54ECBD3D335F34A5F8B068F6E6C96
- SPKI SHA-256: 8A244085108A1DF0FF1E5EF79BFDE4BEB449B231544D34375DAC3A13CA9569CE
- Validity: 2015-05-14 to 2030-05-14
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl05.actalis.it/Repository/AUTHEV-G1/getLastCRL
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3663163709977533131 (0x32d62bfc67501acb)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: May 14 07:00:38 2015 GMT
            Not After : May 14 07:00:38 2030 GMT
        Subject: C = IT, ST = Milano, L = Milano, O = Actalis S.p.A./03358520967, CN = Actalis Extended Validation Server CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Subject Key Identifier:
                61:C1:E4:86:1E:4D:6D:74:74:BC:D9:97:3B:31:71:78:CB:3F:9F:DC
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.it/area-download
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4942AD0441218AEC22DAC417AC499D7DE4C54ECBD3D335F34A5F8B068F6E6C96
    SPKI SHA256: 8A244085108A1DF0FF1E5EF79BFDE4BEB449B231544D34375DAC3A13CA9569CE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Actalis Extended Validation Server CA G2

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Extended Validation Server CA G2
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 16B4F1CC333C425217F7817A6F39A646
- SHA-256: B959B2482B6DB289BF2F04AF99C2323C260B50D45914171292A24D5E5325F3D9
- SPKI SHA-256: EC171E0ADE3B9C15300346A9B3200532B030644B4EB09D077020700632245CCB
- Validity: 2019-03-13 to 2030-09-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            16:b4:f1:cc:33:3c:42:52:17:f7:81:7a:6f:39:a6:46
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Mar 13 08:27:08 2019 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A./03358520967, CN = Actalis Extended Validation Server CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Subject Key Identifier:
                A1:06:8C:F7:35:D0:BA:63:AF:19:08:51:98:87:01:B6:6D:F6:CC:DE
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.it/area-download
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B959B2482B6DB289BF2F04AF99C2323C260B50D45914171292A24D5E5325F3D9
    SPKI SHA256: EC171E0ADE3B9C15300346A9B3200532B030644B4EB09D077020700632245CCB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Actalis Extended Validation Server CA G2

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Extended Validation Server CA G2
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 614AE08B40C7B311D85EDE3D934540DA
- SHA-256: FDB345D269377ED9D34308BB7885632B30E61F8EAFB7EB5E75F8024D5FD4E187
- SPKI SHA-256: EC171E0ADE3B9C15300346A9B3200532B030644B4EB09D077020700632245CCB
- Validity: 2019-03-19 to 2030-09-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:4a:e0:8b:40:c7:b3:11:d8:5e:de:3d:93:45:40:da
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Mar 19 06:49:30 2019 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A./03358520967, CN = Actalis Extended Validation Server CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Subject Key Identifier:
                A1:06:8C:F7:35:D0:BA:63:AF:19:08:51:98:87:01:B6:6D:F6:CC:DE
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.it/area-download
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FDB345D269377ED9D34308BB7885632B30E61F8EAFB7EB5E75F8024D5FD4E187
    SPKI SHA256: EC171E0ADE3B9C15300346A9B3200532B030644B4EB09D077020700632245CCB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Actalis Extended Validation Server CA G3

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Extended Validation Server CA G3
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 03A8A1C2426A2544B92B0B98A61D7FC5
- SHA-256: 124EAAF26F570C4FB4D89F5D61078F15B885345FCAF0C57F3477D8C63B5AB26F
- SPKI SHA-256: 422B7C7ABB4345A956DBF61900DA5F18AB06B8DC5C49E679517A4F83CFE09A91
- Validity: 2020-07-06 to 2030-09-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl05.actalis.it/Repository/AUTHEV-G3/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            03:a8:a1:c2:42:6a:25:44:b9:2b:0b:98:a6:1d:7f:c5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Jul  6 07:36:14 2020 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis Extended Validation Server CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.it/area-download
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                AB:41:73:F0:6F:50:D0:69:FD:73:17:AB:89:B3:6B:62:ED:BD:7C:4B
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 124EAAF26F570C4FB4D89F5D61078F15B885345FCAF0C57F3477D8C63B5AB26F
    SPKI SHA256: 422B7C7ABB4345A956DBF61900DA5F18AB06B8DC5C49E679517A4F83CFE09A91
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Actalis Extended Validation TLS Server ECC CA 2025

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Extended Validation TLS Server ECC CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server ECC Root CA 2025
- Serial: 0E672E884495866362F33791535A6AEF
- SHA-256: 12D8FBFFEB27481EB0EECD032336D6D1E2B1A678A9B1018E653E7FC253D929A5
- SPKI SHA-256: 701DB18A353A9A045FFFE6EF8E7AB5BAE61E34C9C07016A9A68E954EA43260A1
- Validity: 2025-07-07 to 2035-07-05
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl15.actalis.it/Repository/tls-subca-ecc-ev-2025/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp13.actalis.it/va/tls-root-ecc-2025
- CRL DP: http://crl13.actalis.it/Repository/tls-root-ecc-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0e:67:2e:88:44:95:86:63:62:f3:37:91:53:5a:6a:ef
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis TLS Server ECC Root CA 2025
        Validity
            Not Before: Jul  7 14:25:30 2025 GMT
            Not After : Jul  5 14:25:29 2035 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis Extended Validation TLS Server ECC CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                30:22:BD:D5:9A:B5:D2:87:2F:FF:A6:7C:A3:B5:4C:16:57:F0:AE:0C
            Authority Information Access:
                CA Issuers - URI:http://cacert.actalis.it/certs/tls-root-ecc-2025
                OCSP - URI:http://ocsp13.actalis.it/va/tls-root-ecc-2025
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.com/legal-repository
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl13.actalis.it/Repository/tls-root-ecc-2025/getLastCRL
            X509v3 Subject Key Identifier:
                E9:93:0A:29:44:61:D9:7E:66:65:81:47:D3:BF:30:63:4C:5F:71:74
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 12D8FBFFEB27481EB0EECD032336D6D1E2B1A678A9B1018E653E7FC253D929A5
    SPKI SHA256: 701DB18A353A9A045FFFE6EF8E7AB5BAE61E34C9C07016A9A68E954EA43260A1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp13.actalis.it/va/tls-root-ecc-2025
- AIA CA Issuers: http://cacert.actalis.it/certs/tls-root-ecc-2025
- CRL Distribution Points: http://crl13.actalis.it/Repository/tls-root-ecc-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Actalis Extended Validation TLS Server RSA CA 2025

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Extended Validation TLS Server RSA CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server RSA Root CA 2025
- Serial: 4796F620EDAF547E48BE60873C1C0868
- SHA-256: 8FA40E1594EB493E5D2954F577BB50473A3512F2D203A99B402BBCB608AED73B
- SPKI SHA-256: 2E4711A1E5F6D675DD4BFEC6EE0633619925D3E9C17D874CCF01579A356CB893
- Validity: 2025-07-07 to 2035-07-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl15.actalis.it/Repository/tls-subca-rsa-ev-2025/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp13.actalis.it/va/tls-root-rsa-2025
- CRL DP: http://crl13.actalis.it/Repository/tls-root-rsa-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:96:f6:20:ed:af:54:7e:48:be:60:87:3c:1c:08:68
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis TLS Server RSA Root CA 2025
        Validity
            Not Before: Jul  7 14:21:24 2025 GMT
            Not After : Jul  5 14:21:23 2035 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis Extended Validation TLS Server RSA CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                AF:53:50:61:72:E9:72:04:31:41:DB:0E:66:CF:75:3A:F6:0E:BF:CF
            Authority Information Access:
                CA Issuers - URI:http://cacert.actalis.it/certs/tls-root-rsa-2025
                OCSP - URI:http://ocsp13.actalis.it/va/tls-root-rsa-2025
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.com/legal-repository
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl13.actalis.it/Repository/tls-root-rsa-2025/getLastCRL
            X509v3 Subject Key Identifier:
                1D:82:12:B8:87:44:67:FB:45:F8:3C:2D:59:C7:D2:FF:F3:06:C9:22
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 8FA40E1594EB493E5D2954F577BB50473A3512F2D203A99B402BBCB608AED73B
    SPKI SHA256: 2E4711A1E5F6D675DD4BFEC6EE0633619925D3E9C17D874CCF01579A356CB893
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp13.actalis.it/va/tls-root-rsa-2025
- AIA CA Issuers: http://cacert.actalis.it/certs/tls-root-rsa-2025
- CRL Distribution Points: http://crl13.actalis.it/Repository/tls-root-rsa-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Actalis Organization Validated Server CA G1

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Organization Validated Server CA G1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 0B50BBAC02AD30D5
- SHA-256: 3651F9B36A1DA983200C6EE4EFCECFA4DEFC059466689DAA1A6DB684A54C9E7B
- SPKI SHA-256: A662AEC4C15A2EFEEF7BD3CB8C68A522DBED7604CAF6E2124DA0C605948EDE44
- Validity: 2018-01-17 to 2030-09-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl09.actalis.it/Repository/AUTHOV-G1/getLastCRL
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 815357880007733461 (0xb50bbac02ad30d5)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Jan 17 08:43:22 2018 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A./03358520967, CN = Actalis Organization Validated Server CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Subject Key Identifier:
                23:B4:CC:8E:BE:20:F9:24:D5:A9:90:A5:0A:26:39:8E:D5:95:05:96
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.it/area-download
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3651F9B36A1DA983200C6EE4EFCECFA4DEFC059466689DAA1A6DB684A54C9E7B
    SPKI SHA256: A662AEC4C15A2EFEEF7BD3CB8C68A522DBED7604CAF6E2124DA0C605948EDE44
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Actalis Organization Validated Server CA G2

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Organization Validated Server CA G2
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 6E898B681DB091FC533C8CD63FD800E7
- SHA-256: 829B68B97F11DEE344857AC12EB40CE502EE52601123016FDEBF1420091A4048
- SPKI SHA-256: ECEAD5111D5D8CD3B59FDEF78A4E699F75F7CF631C5CB878FD41E0E2070FF10B
- Validity: 2019-03-21 to 2030-09-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6e:89:8b:68:1d:b0:91:fc:53:3c:8c:d6:3f:d8:00:e7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Mar 21 08:35:02 2019 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A./03358520967, CN = Actalis Organization Validated Server CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Subject Key Identifier:
                62:FE:BB:27:8A:64:44:ED:68:96:5A:58:79:A1:DB:5A:26:AD:FF:BB
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.it/area-download
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 829B68B97F11DEE344857AC12EB40CE502EE52601123016FDEBF1420091A4048
    SPKI SHA256: ECEAD5111D5D8CD3B59FDEF78A4E699F75F7CF631C5CB878FD41E0E2070FF10B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Actalis Organization Validated Server CA G3

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Organization Validated Server CA G3
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 5C3B3F37ADFC28FE0FCFD3ABF83F8551
- SHA-256: 931AAA1EC9B2BA0FA59A82302F4F830628C86D9B2D2A50A4D1B2CE895C4CC648
- SPKI SHA-256: 6D7D918BA973E14A82758767B666C54EBA66BF4CD5C44AA18021C2BBD415DBBF
- Validity: 2020-07-06 to 2030-09-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl09.actalis.it/Repository/AUTHOV-G3/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5c:3b:3f:37:ad:fc:28:fe:0f:cf:d3:ab:f8:3f:85:51
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Jul  6 07:20:55 2020 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis Organization Validated Server CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.it/area-download
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                9F:8A:B1:B5:F1:B1:DE:82:F4:27:7C:BE:88:CD:DE:A9:43:81:A3:4B
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 931AAA1EC9B2BA0FA59A82302F4F830628C86D9B2D2A50A4D1B2CE895C4CC648
    SPKI SHA256: 6D7D918BA973E14A82758767B666C54EBA66BF4CD5C44AA18021C2BBD415DBBF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap05.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Actalis Organization Validated TLS Server ECC CA 2025

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Organization Validated TLS Server ECC CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server ECC Root CA 2025
- Serial: 65397BE4D27323AB9E250FCADE9E70F1
- SHA-256: E7929CDA1A88D2E94016A3F2D52BE95DB1C28C178C425B4303A82E3E29293544
- SPKI SHA-256: 8428B6001758BEAA4877D2968E449CE00CEBC4B1BBBEDCFCBEAAAF46D4C9DD85
- Validity: 2025-07-07 to 2035-07-05
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl15.actalis.it/Repository/tls-subca-ecc-ov-2025/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp13.actalis.it/va/tls-root-ecc-2025
- CRL DP: http://crl13.actalis.it/Repository/tls-root-ecc-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            65:39:7b:e4:d2:73:23:ab:9e:25:0f:ca:de:9e:70:f1
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis TLS Server ECC Root CA 2025
        Validity
            Not Before: Jul  7 13:16:27 2025 GMT
            Not After : Jul  5 13:16:26 2035 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis Organization Validated TLS Server ECC CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                30:22:BD:D5:9A:B5:D2:87:2F:FF:A6:7C:A3:B5:4C:16:57:F0:AE:0C
            Authority Information Access:
                CA Issuers - URI:http://cacert.actalis.it/certs/tls-root-ecc-2025
                OCSP - URI:http://ocsp13.actalis.it/va/tls-root-ecc-2025
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.com/legal-repository
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl13.actalis.it/Repository/tls-root-ecc-2025/getLastCRL
            X509v3 Subject Key Identifier:
                18:E0:1E:84:37:F4:EA:BF:01:0A:C9:10:00:A5:F8:54:DA:FB:3E:A5
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E7929CDA1A88D2E94016A3F2D52BE95DB1C28C178C425B4303A82E3E29293544
    SPKI SHA256: 8428B6001758BEAA4877D2968E449CE00CEBC4B1BBBEDCFCBEAAAF46D4C9DD85
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp13.actalis.it/va/tls-root-ecc-2025
- AIA CA Issuers: http://cacert.actalis.it/certs/tls-root-ecc-2025
- CRL Distribution Points: http://crl13.actalis.it/Repository/tls-root-ecc-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Actalis Organization Validated TLS Server RSA CA 2025

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Organization Validated TLS Server RSA CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server RSA Root CA 2025
- Serial: 527806C74BF6C3FCF9A620355DA319B8
- SHA-256: BAE1C37CEE8621A3016AE4E76E36204949DA3160BCE5AE56CF4003860EE3B2CD
- SPKI SHA-256: 482042EDC0B640EE208C5D14A981DDA430935CF4F7B7922E7F3F18A3C95767AF
- Validity: 2025-07-07 to 2035-07-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl15.actalis.it/Repository/tls-subca-rsa-ov-2025/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp13.actalis.it/va/tls-root-rsa-2025
- CRL DP: http://crl13.actalis.it/Repository/tls-root-rsa-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:78:06:c7:4b:f6:c3:fc:f9:a6:20:35:5d:a3:19:b8
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis TLS Server RSA Root CA 2025
        Validity
            Not Before: Jul  7 13:10:11 2025 GMT
            Not After : Jul  5 13:10:10 2035 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis Organization Validated TLS Server RSA CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                AF:53:50:61:72:E9:72:04:31:41:DB:0E:66:CF:75:3A:F6:0E:BF:CF
            Authority Information Access:
                CA Issuers - URI:http://cacert.actalis.it/certs/tls-root-rsa-2025
                OCSP - URI:http://ocsp13.actalis.it/va/tls-root-rsa-2025
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.com/legal-repository
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl13.actalis.it/Repository/tls-root-rsa-2025/getLastCRL
            X509v3 Subject Key Identifier:
                AF:2C:A4:06:CB:F0:8A:03:14:65:13:A8:8D:60:F9:C8:D3:1B:41:4C
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: BAE1C37CEE8621A3016AE4E76E36204949DA3160BCE5AE56CF4003860EE3B2CD
    SPKI SHA256: 482042EDC0B640EE208C5D14A981DDA430935CF4F7B7922E7F3F18A3C95767AF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp13.actalis.it/va/tls-root-rsa-2025
- AIA CA Issuers: http://cacert.actalis.it/certs/tls-root-rsa-2025
- CRL Distribution Points: http://crl13.actalis.it/Repository/tls-root-rsa-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Actalis SMIME ECC CA 2025

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis SMIME ECC CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis SMIME ECC Root CA 2025
- Serial: 4E5B8CD6A3FC28587F12CC69D1755078
- SHA-256: 1355E3FB05515C81D526E921C27B5001EF4A0BCCB7DCC26E6FC8CA66107B5564
- SPKI SHA-256: 928766A237D560496D8F7B432539207EC1A574BA19F227FAA5AE047CC6D6DE25
- Validity: 2025-07-07 to 2035-07-05
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl15.actalis.it/Repository/tls-subca-ecc-smime-2025/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp13.actalis.it/va/smime-root-ecc-2025
- CRL DP: http://crl13.actalis.it/Repository/smime-root-ecc-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4e:5b:8c:d6:a3:fc:28:58:7f:12:cc:69:d1:75:50:78
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis SMIME ECC Root CA 2025
        Validity
            Not Before: Jul  7 15:08:07 2025 GMT
            Not After : Jul  5 15:08:06 2035 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis SMIME ECC CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                8D:6F:BC:F6:76:D1:CA:7D:86:DD:AB:D0:2A:96:99:C8:F1:63:B2:29
            Authority Information Access:
                CA Issuers - URI:http://cacert.actalis.it/certs/smime-root-ecc-2025
                OCSP - URI:http://ocsp13.actalis.it/va/smime-root-ecc-2025
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.com/legal-repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl13.actalis.it/Repository/smime-root-ecc-2025/getLastCRL
            X509v3 Subject Key Identifier:
                49:2F:9B:45:15:A1:5C:E6:79:9F:C6:39:FF:6E:F7:18:47:EC:5D:29
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1355E3FB05515C81D526E921C27B5001EF4A0BCCB7DCC26E6FC8CA66107B5564
    SPKI SHA256: 928766A237D560496D8F7B432539207EC1A574BA19F227FAA5AE047CC6D6DE25
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp13.actalis.it/va/smime-root-ecc-2025
- AIA CA Issuers: http://cacert.actalis.it/certs/smime-root-ecc-2025
- CRL Distribution Points: http://crl13.actalis.it/Repository/smime-root-ecc-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Actalis SMIME RSA CA 2025

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis SMIME RSA CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis SMIME RSA Root CA 2025
- Serial: 3C050363FB7CDA8750E3167DA56DEF18
- SHA-256: 886B66D00BE5BD6EACECACB698BADF680B1CFF268CA2F575D8628CD15A6465E4
- SPKI SHA-256: 5F14E20B96BD6BB048BC2DFEED56507503A2A527E39CB1ED24E53F3E87A7AD57
- Validity: 2025-07-07 to 2035-07-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl15.actalis.it/Repository/tls-subca-rsa-smime-2025/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp13.actalis.it/va/smime-root-rsa-2025
- CRL DP: http://crl13.actalis.it/Repository/smime-root-rsa-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3c:05:03:63:fb:7c:da:87:50:e3:16:7d:a5:6d:ef:18
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis SMIME RSA Root CA 2025
        Validity
            Not Before: Jul  7 14:56:00 2025 GMT
            Not After : Jul  5 14:55:59 2035 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis SMIME RSA CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                F3:EF:A2:39:AA:77:3B:C2:AD:6A:9F:FC:2E:58:00:FE:5B:BF:47:51
            Authority Information Access:
                CA Issuers - URI:http://cacert.actalis.it/certs/smime-root-rsa-2025
                OCSP - URI:http://ocsp13.actalis.it/va/smime-root-rsa-2025
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.com/legal-repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl13.actalis.it/Repository/smime-root-rsa-2025/getLastCRL
            X509v3 Subject Key Identifier:
                8D:E8:AF:D2:E4:FE:55:20:49:3F:F2:83:22:F0:A0:39:89:22:84:45
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 886B66D00BE5BD6EACECACB698BADF680B1CFF268CA2F575D8628CD15A6465E4
    SPKI SHA256: 5F14E20B96BD6BB048BC2DFEED56507503A2A527E39CB1ED24E53F3E87A7AD57
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp13.actalis.it/va/smime-root-rsa-2025
- AIA CA Issuers: http://cacert.actalis.it/certs/smime-root-rsa-2025
- CRL Distribution Points: http://crl13.actalis.it/Repository/smime-root-rsa-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Actalis SMIME RSA Root CA 2025

- Subject: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis SMIME RSA Root CA 2025
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 524FF14A69D885358630CDEA71D0FDED
- SHA-256: 180FE239D04EE0300095205970D2BD4928A257319A46EB6D2FC42C5564F6CB68
- SPKI SHA-256: 7E9653B325D0E74E82F2C53E71F71BAE85C56D8A58F67B366A3382A25EE1BC7F
- Validity: 2025-08-07 to 2030-09-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.actalis.com/cp-cps-smime-certificates
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl13.actalis.it/Repository/smime-root-rsa-2025/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:4f:f1:4a:69:d8:85:35:86:30:cd:ea:71:d0:fd:ed
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Aug  7 08:14:57 2025 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, O = Actalis S.p.A., CN = Actalis SMIME RSA Root CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                F3:EF:A2:39:AA:77:3B:C2:AD:6A:9F:FC:2E:58:00:FE:5B:BF:47:51
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 180FE239D04EE0300095205970D2BD4928A257319A46EB6D2FC42C5564F6CB68
    SPKI SHA256: 7E9653B325D0E74E82F2C53E71F71BAE85C56D8A58F67B366A3382A25EE1BC7F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp

### Actalis Time Stamping CA G1

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Time Stamping CA G1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 161FE12B3A002D1ECED6147250D5D90E
- SHA-256: AA0CA7B6C6A4DD5335761A7213801B3D2D1829CDD0A72F4587F8830804A03B7E
- SPKI SHA-256: 9C34C8A1EC27E28F155F8BC7A0665DDB5DA807D20D1C23F3533D71E5D9D0EE2C
- Validity: 2023-03-10 to 2030-09-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl09.actalis.it/Repository/AUTHTS-G1/getLastCRL0
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.23.140.1.4.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            16:1f:e1:2b:3a:00:2d:1e:ce:d6:14:72:50:d5:d9:0e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Mar 10 13:01:51 2023 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis Time Stamping CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                CA Issuers - URI:http://cacert.actalis.it/certs/actalis-autroot
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.4.2
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                D7:9C:73:39:2D:7D:F0:D9:E4:16:4A:50:23:53:00:6D:4E:FD:11:A3
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AA0CA7B6C6A4DD5335761A7213801B3D2D1829CDD0A72F4587F8830804A03B7E
    SPKI SHA256: 9C34C8A1EC27E28F155F8BC7A0665DDB5DA807D20D1C23F3533D71E5D9D0EE2C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.23.140.1.4.2
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: http://cacert.actalis.it/certs/actalis-autroot
- CRL Distribution Points: http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Actalis Time Stamping ECC CA 2025

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Time Stamping ECC CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis Time Stamping ECC Root CA 2025
- Serial: 522C0E42318E3A01E0D4EBE6E47315C0
- SHA-256: C6C508DC81B4309393B745E384DC85BB55E6E44C04BBF3C8029E21190D562F92
- SPKI SHA-256: 82AAA8994E7150533E22A1B89AD7300E91AD55EFDD4B4E855D2DD3554338E0F6
- Validity: 2025-10-02 to 2040-09-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl15.actalis.it/Repository/timestamp-subca-ecc-2025/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp13.actalis.it/va/timestamp-root-ecc-2025
- CRL DP: http://crl13.actalis.it/Repository/timestamp-root-ecc-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:2c:0e:42:31:8e:3a:01:e0:d4:eb:e6:e4:73:15:c0
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis Time Stamping ECC Root CA 2025
        Validity
            Not Before: Oct  2 08:35:17 2025 GMT
            Not After : Sep 28 08:35:16 2040 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis Time Stamping ECC CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                18:8C:2A:60:7B:02:CB:4A:40:9B:03:86:79:77:6E:74:AD:50:81:AE
            Authority Information Access:
                CA Issuers - URI:http://cacert.actalis.it/certs/timestamp-root-ecc-2025
                OCSP - URI:http://ocsp13.actalis.it/va/timestamp-root-ecc-2025
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.com/legal-repository
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl13.actalis.it/Repository/timestamp-root-ecc-2025/getLastCRL
            X509v3 Subject Key Identifier:
                69:10:0E:6C:44:3A:A4:EE:26:44:9C:F9:76:20:7A:F2:01:17:F5:9C
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C6C508DC81B4309393B745E384DC85BB55E6E44C04BBF3C8029E21190D562F92
    SPKI SHA256: 82AAA8994E7150533E22A1B89AD7300E91AD55EFDD4B4E855D2DD3554338E0F6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp13.actalis.it/va/timestamp-root-ecc-2025
- AIA CA Issuers: http://cacert.actalis.it/certs/timestamp-root-ecc-2025
- CRL Distribution Points: http://crl13.actalis.it/Repository/timestamp-root-ecc-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Actalis Time Stamping RSA CA 2025

- Subject: countryName=IT, stateOrProvinceName=Bergamo, localityName=Ponte San Pietro, organizationName=Actalis S.p.A., commonName=Actalis Time Stamping RSA CA 2025
- Issuer: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis Time Stamping RSA Root CA 2025
- Serial: 40E6902600012466B843CBF0BF09893C
- SHA-256: 4CF6CB96EF4E87C9808258A2B5E6D857FB0166CEDD6A6EF787DE3E749B507196
- SPKI SHA-256: 52B32456C0975A07F38BF550944767EDBCAF79FD6AF0DF38A9479BC417C92E6E
- Validity: 2025-10-02 to 2040-09-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl15.actalis.it/Repository/timestamp-subca-rsa-2025/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp13.actalis.it/va/timestamp-root-rsa-2025
- CRL DP: http://crl13.actalis.it/Repository/timestamp-root-rsa-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            40:e6:90:26:00:01:24:66:b8:43:cb:f0:bf:09:89:3c
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = IT, O = Actalis S.p.A., CN = Actalis Time Stamping RSA Root CA 2025
        Validity
            Not Before: Oct  2 08:26:02 2025 GMT
            Not After : Sep 28 08:26:01 2040 GMT
        Subject: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis Time Stamping RSA CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                E8:D3:0E:4D:B1:76:41:22:80:19:4D:50:48:84:F2:2F:35:90:9D:8E
            Authority Information Access:
                CA Issuers - URI:http://cacert.actalis.it/certs/timestamp-root-rsa-2025
                OCSP - URI:http://ocsp13.actalis.it/va/timestamp-root-rsa-2025
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.actalis.com/legal-repository
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl13.actalis.it/Repository/timestamp-root-rsa-2025/getLastCRL
            X509v3 Subject Key Identifier:
                94:F0:8A:BF:A3:D9:C1:7B:67:71:CC:26:19:2B:E8:55:03:F6:2D:48
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 4CF6CB96EF4E87C9808258A2B5E6D857FB0166CEDD6A6EF787DE3E749B507196
    SPKI SHA256: 52B32456C0975A07F38BF550944767EDBCAF79FD6AF0DF38A9479BC417C92E6E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp13.actalis.it/va/timestamp-root-rsa-2025
- AIA CA Issuers: http://cacert.actalis.it/certs/timestamp-root-rsa-2025
- CRL Distribution Points: http://crl13.actalis.it/Repository/timestamp-root-rsa-2025/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Actalis TLS Server ECC Root CA 2025

- Subject: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server ECC Root CA 2025
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 088765199EA3DF08F2D9F4257CE390AD
- SHA-256: E3C737BC523C046F08F38F89410E7D07B41584E31B7341FF9D4B3BF18F2D7795
- SPKI SHA-256: CCA4EB68C98622E2264879B61562EAD139559C91FE6B6AB3081EB19631426855
- Validity: 2025-07-30 to 2030-09-22
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: Any Extended Key Usage
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            08:87:65:19:9e:a3:df:08:f2:d9:f4:25:7c:e3:90:ad
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Jul 30 07:48:45 2025 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, O = Actalis S.p.A., CN = Actalis TLS Server ECC Root CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Any Extended Key Usage
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                30:22:BD:D5:9A:B5:D2:87:2F:FF:A6:7C:A3:B5:4C:16:57:F0:AE:0C
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: E3C737BC523C046F08F38F89410E7D07B41584E31B7341FF9D4B3BF18F2D7795
    SPKI SHA256: CCA4EB68C98622E2264879B61562EAD139559C91FE6B6AB3081EB19631426855
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: Any Extended Key Usage
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp

### Actalis TLS Server ECC Root CA 2025

- Subject: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server ECC Root CA 2025
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 082CDA83152D404731E1ECEA538371C4
- SHA-256: 471F644699FD038E07D73D6E980586AA232FA7DCAD57380B0C89EDD1DCFDB61E
- SPKI SHA-256: CCA4EB68C98622E2264879B61562EAD139559C91FE6B6AB3081EB19631426855
- Validity: 2025-08-07 to 2030-09-22
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.actalis.com/cps-for-tsl-server-certificates
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl13.actalis.it/Repository/tls-root-ecc-2025/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            08:2c:da:83:15:2d:40:47:31:e1:ec:ea:53:83:71:c4
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Aug  7 08:09:33 2025 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, O = Actalis S.p.A., CN = Actalis TLS Server ECC Root CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                30:22:BD:D5:9A:B5:D2:87:2F:FF:A6:7C:A3:B5:4C:16:57:F0:AE:0C
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 471F644699FD038E07D73D6E980586AA232FA7DCAD57380B0C89EDD1DCFDB61E
    SPKI SHA256: CCA4EB68C98622E2264879B61562EAD139559C91FE6B6AB3081EB19631426855
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp

### Actalis TLS Server RSA Root CA 2025

- Subject: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server RSA Root CA 2025
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 280FB913C39213858DDC92C1E8A2A18A
- SHA-256: B9F12DE9F1B76B86A6B2875D6D83D65EF32A74459EE89A6E1A1540A7468C8BBF
- SPKI SHA-256: 8F94CEDD9A5C168BE13D0511F67E92664E89876224CEF12F7FCEB91A67F8E6F0
- Validity: 2025-07-30 to 2030-09-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: Any Extended Key Usage
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            28:0f:b9:13:c3:92:13:85:8d:dc:92:c1:e8:a2:a1:8a
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Jul 30 06:36:44 2025 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, O = Actalis S.p.A., CN = Actalis TLS Server RSA Root CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Any Extended Key Usage
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                AF:53:50:61:72:E9:72:04:31:41:DB:0E:66:CF:75:3A:F6:0E:BF:CF
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: B9F12DE9F1B76B86A6B2875D6D83D65EF32A74459EE89A6E1A1540A7468C8BBF
    SPKI SHA256: 8F94CEDD9A5C168BE13D0511F67E92664E89876224CEF12F7FCEB91A67F8E6F0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: Any Extended Key Usage
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp

### Actalis TLS Server RSA Root CA 2025

- Subject: countryName=IT, organizationName=Actalis S.p.A., commonName=Actalis TLS Server RSA Root CA 2025
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 2328B3ED98429C6559985F3DAA3C6E04
- SHA-256: 944D87943C5B47F4DBCE29F55CF92CDA8F27556BE6237D1C51D1B7E574F189D0
- SPKI SHA-256: 8F94CEDD9A5C168BE13D0511F67E92664E89876224CEF12F7FCEB91A67F8E6F0
- Validity: 2025-08-07 to 2030-09-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.actalis.com/cps-for-tsl-server-certificates
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl13.actalis.it/Repository/tls-root-rsa-2025/getLastCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- CRL DP: http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            23:28:b3:ed:98:42:9c:65:59:98:5f:3d:aa:3c:6e:04
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Aug  7 07:39:27 2025 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, O = Actalis S.p.A., CN = Actalis TLS Server RSA Root CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                OCSP - URI:http://ocsp05.actalis.it/VA/AUTH-ROOT
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                AF:53:50:61:72:E9:72:04:31:41:DB:0E:66:CF:75:3A:F6:0E:BF:CF
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 944D87943C5B47F4DBCE29F55CF92CDA8F27556BE6237D1C51D1B7E574F189D0
    SPKI SHA256: 8F94CEDD9A5C168BE13D0511F67E92664E89876224CEF12F7FCEB91A67F8E6F0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp05.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: http://crl05.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp

### AgID CA SSL SERVER

- Subject: countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA SSL SERVER
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 4AFE3AD519F629EB7871927DF3CD5C07
- SHA-256: 8B7ED5358484781F4C08376B183B018C957908CAAC32AA72ACD02E51707A58A7
- SPKI SHA-256: C40EC8BEA3F5FA3C1112064914A3F762B233126D51D25BFE829F3ADCA106CA6F
- Validity: 2021-11-24 to 2030-09-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_tls_v1.0_en_20260717.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://ca1.agid.gov.it/SSLCRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 1.3.76.16.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4a:fe:3a:d5:19:f6:29:eb:78:71:92:7d:f3:cd:5c:07
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Nov 24 10:24:27 2021 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, L = Roma, O = Agenzia per l'Italia Digitale, OU = Area Soluzioni per la Pubblica Amministrazione, CN = AgID CA SSL SERVER
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                CA Issuers - URI:http://cacert.actalis.it/certs/actalis-autroot
                OCSP - URI:http://ocsp07.actalis.it/VA/AUTH-ROOT
            X509v3 Name Constraints: critical
                Permitted:
                  DNS:agendadigitale.it
                  DNS:agid-ca1-test.it
                  DNS:agid.it
                  DNS:aipa.it
                  DNS:cert-spc.it
                  DNS:crcitalia.it
                  DNS:difensorecivicodigitale.it
                  DNS:digitalagenda.it
                  DNS:digitpa.it
                  DNS:gov.it
                  DNS:italia.it
                  DNS:cnipa.it
                  DNS:cert-pa.it
                  DNS:indicepa.it
                  DirName:C = IT, ST = Roma, L = Roma, O = Agenzia per l'Italia Digitale
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 Certificate Policies:
                Policy: 1.3.76.16.3.1
                  CPS: http://www.agid.gov.it/certificati-firma-pec
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                2A:B7:A6:10:B6:86:3F:43:B8:FD:CF:4A:FA:88:BF:32:93:23:CF:B4
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8B7ED5358484781F4C08376B183B018C957908CAAC32AA72ACD02E51707A58A7
    SPKI SHA256: C40EC8BEA3F5FA3C1112064914A3F762B233126D51D25BFE829F3ADCA106CA6F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 1.3.76.16.3.1
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: http://cacert.actalis.it/certs/actalis-autroot
- CRL Distribution Points: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### AgID CA1

- Subject: countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 6720EFB9B071E75B
- SHA-256: 4648900B04272628AB7B2D82DDF74CD5B78D77F8652D5BBF2824BB64DD178659
- SPKI SHA-256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
- Validity: 2018-04-04 to 2028-04-03
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v6.0_del_29-11-2021.pdf, https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v6.0_del_29-11-2021.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://ca1.agid.gov.it/CRL
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.numera.it","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7431202965969561435 (0x6720efb9b071e75b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Apr  4 12:21:02 2018 GMT
            Not After : Apr  3 12:21:02 2028 GMT
        Subject: C = IT, L = Roma, O = Agenzia per l'Italia Digitale, OU = Area Soluzioni per la Pubblica Amministrazione, CN = AgID CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Name Constraints:
                Permitted:
                  email:agid.gov.it
                  email:cert.informatica.aci.it
                  email:cert.interno.it
                  email:emarche.it
                  email:fastweb-pec.it
                  email:gestorepec.unina.it
                  email:kmailer.it
                  email:legalmail.it
                  email:pcert.sogei.it
                  email:pec.actalis.it
                  email:pec.ancitel.it
                  email:pec.aruba.it
                  email:pec.basilicatanet.it
                  email:pec-email.com
                  email:pec.numera.it
                  email:pec.postecert.it
                  email:pec.posteitaliane.it
                  email:pec.rupar.puglia.it
                  email:postacert.cedacri.it
                  email:postacertificata.notariato.it
                  email:postacert.it.net
                  email:postecert.it
                  email:sicurezzapostale.it
                  email:telecompost.it
                  email:trustedmail.intesa.it
                  email:twtcert.it
                  email:zucchettipec.it
                  email:cert.intesa.it
                  email:certmail.kpnqwest.it
                  DNS:agid-ca1-test.it
                  DNS:agid.gov.it
                  DNS:avanzamentodigitale.italia.it
                  DNS:cert-pa.it
                  DNS:cnipa.it
                  DNS:fascicolosanitario.gov.it
                  DNS:indicepa.gov.it
                  DNS:pagopa.gov.it
                  DNS:postacertificata.gov.it
                  DNS:rndt.gov.it
                  DNS:spcoop.gov.it
                  DNS:spid.gov.it
                  DNS:icspc.gov.it
                  DirName:C = IT, ST = Roma, L = Roma, O = ACI Informatica S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Aruba PEC S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Agenzia per l'Italia Digitale
                  DirName:C = IT, ST = Roma, L = Roma, O = Ancitel S.p.A.
                  DirName:C = IT, ST = Parma, L = Collecchio, O = Cedacri S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Consiglio Nazionale del Notariato
                  DirName:C = IT, ST = Milano, L = Milano, O = Fastweb S.p.A.
                  DirName:C = IT, ST = Milano, L = Assago, O = ITnet S.r.l.
                  DirName:C = IT, ST = Torino, L = Torino, O = In.Te.S.A. S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = InfoCert S.p.A.
                  DirName:C = IT, ST = Bari, L = Valenzano, O = InnovaPuglia S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = KPNQwest Italia S.p.A.
                  DirName:C = IT, ST = Ancona, L = Senigallia, O = Namirial S.p.A.
                  DirName:C = IT, ST = Sassari, L = Sassari, O = Numera Sistemi e Informatica S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Poste Italiane S.p.A.
                  DirName:C = IT, ST = Potenza, L = Potenza, O = Regione Basilicata
                  DirName:C = IT, ST = Ancona, L = Ancona, O = Regione Marche
                  DirName:C = IT, ST = Firenze, L = Firenze, O = Register.it S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Sogei S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = TWT S.p.A.
                  DirName:C = IT, ST = Roma, L = Pomezia, O = Telecom Italia Trust Technologies S.r.l.
                  DirName:C = IT, ST = Napoli, L = Napoli, O = UNIVERSITA DEGLI STUDI DI NAPOLI FEDERICO II
                  DirName:C = IT, ST = Lodi, L = Lodi, O = Zucchetti S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = KPNQWEST ITALIA S.r.l.
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            Authority Information Access:
                OCSP - URI:http://ocsp07.actalis.it/VA/AUTH-ROOT
            X509v3 Subject Key Identifier:
                A5:FD:85:05:0E:C3:F1:D6:65:4A:20:6C:E2:DB:4D:60:93:2B:8A:A0
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Certificate Policies:
                Policy: 1.3.76.16.3.1
                  CPS: http://www.agid.gov.it/certificati-firma-pec
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, E-mail Protection
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4648900B04272628AB7B2D82DDF74CD5B78D77F8652D5BBF2824BB64DD178659
    SPKI SHA256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.numera.it","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### AgID CA1

- Subject: countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 68043BDC4CB05A89117E1BFD692771F7
- SHA-256: 32322AE2E31A7430BE1D6C04BD8CABFBD240C74D2C9DBE82780DB1F3F73660A6
- SPKI SHA-256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
- Validity: 2021-09-21 to 2030-09-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v6.0_del_29-11-2021.pdf, https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v6.0_del_29-11-2021.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://ca1.agid.gov.it/CRL
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it","email:pupec.informatica.aci.it","email:pro.sicurezzapostale.it","email:pec.bill4me.it","email:pec.notartel.it","email:miapec.it","email:ig-trustmail.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            68:04:3b:dc:4c:b0:5a:89:11:7e:1b:fd:69:27:71:f7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Sep 21 06:30:58 2021 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, L = Roma, O = Agenzia per l'Italia Digitale, OU = Area Soluzioni per la Pubblica Amministrazione, CN = AgID CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                CA Issuers - URI:http://cacert.actalis.it/certs/actalis-autroot
                OCSP - URI:http://ocsp07.actalis.it/VA/AUTH-ROOT
            X509v3 Name Constraints:
                Permitted:
                  email:agid.gov.it
                  email:cert.informatica.aci.it
                  email:cert.interno.it
                  email:emarche.it
                  email:fastweb-pec.it
                  email:gestorepec.unina.it
                  email:kmailer.it
                  email:legalmail.it
                  email:pcert.sogei.it
                  email:pec.actalis.it
                  email:pec.ancitel.it
                  email:pec.aruba.it
                  email:pec.basilicatanet.it
                  email:pec-email.com
                  email:pec.postecert.it
                  email:pec.posteitaliane.it
                  email:pec.rupar.puglia.it
                  email:postacert.cedacri.it
                  email:postacertificata.notariato.it
                  email:postacert.it.net
                  email:postecert.it
                  email:sicurezzapostale.it
                  email:telecompost.it
                  email:trustedmail.intesa.it
                  email:twtcert.it
                  email:zucchettipec.it
                  email:cert.intesa.it
                  email:certmail.kpnqwest.it
                  email:certmail.irideos.it
                  email:pupec.informatica.aci.it
                  email:pro.sicurezzapostale.it
                  email:pec.bill4me.it
                  email:pec.notartel.it
                  email:miapec.it
                  email:ig-trustmail.com
                  DirName:C = IT, ST = Roma, L = Roma, O = ACI Informatica S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Aruba PEC S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Agenzia per l'Italia Digitale
                  DirName:C = IT, ST = Roma, L = Roma, O = Ancitel S.p.A.
                  DirName:C = IT, ST = Parma, L = Collecchio, O = Cedacri S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Consiglio Nazionale del Notariato
                  DirName:C = IT, ST = Milano, L = Milano, O = Fastweb S.p.A.
                  DirName:C = IT, ST = Milano, L = Assago, O = ITnet S.r.l.
                  DirName:C = IT, ST = Torino, L = Torino, O = In.Te.S.A. S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = InfoCert S.p.A.
                  DirName:C = IT, ST = Bari, L = Valenzano, O = InnovaPuglia S.p.A.
                  DirName:C = IT, ST = Ancona, L = Senigallia, O = Namirial S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Poste Italiane S.p.A.
                  DirName:C = IT, ST = Potenza, L = Potenza, O = Regione Basilicata
                  DirName:C = IT, ST = Ancona, L = Ancona, O = Regione Marche
                  DirName:C = IT, ST = Firenze, L = Firenze, O = Register S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Sogei S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = TWT S.p.A.
                  DirName:C = IT, ST = Roma, L = Pomezia, O = Telecom Italia Trust Technologies S.r.l.
                  DirName:C = IT, ST = Napoli, L = Napoli, O = UNIVERSITA DEGLI STUDI DI NAPOLI FEDERICO II
                  DirName:C = IT, ST = Lodi, L = Lodi, O = Zucchetti S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = KPNQWEST ITALIA S.r.l.
                  DirName:C = IT, ST = Milano, L = Milano, O = IRIDEOS S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Notartel S.p.A.
                  DirName:C = IT, ST = Torino, L = Torino, O = Telsy S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = Intesi Group S.p.A.
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 Certificate Policies:
                Policy: 1.3.76.16.3.1
                  CPS: http://www.agid.gov.it/certificati-firma-pec
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                A5:FD:85:05:0E:C3:F1:D6:65:4A:20:6C:E2:DB:4D:60:93:2B:8A:A0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 32322AE2E31A7430BE1D6C04BD8CABFBD240C74D2C9DBE82780DB1F3F73660A6
    SPKI SHA256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: http://cacert.actalis.it/certs/actalis-autroot
- CRL Distribution Points: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it","email:pupec.informatica.aci.it","email:pro.sicurezzapostale.it","email:pec.bill4me.it","email:pec.notartel.it","email:miapec.it","email:ig-trustmail.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### AgID CA1

- Subject: countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, commonName=AgID CA1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 32BE161761D08EB6A3B0D547E89C79CD
- SHA-256: 0E19FD9967322133BD7A173B4851A90F3FC575A98507113D86C4D5EFE361B06E
- SPKI SHA-256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
- Validity: 2025-01-21 to 2030-09-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://ca1.agid.gov.it/CRL
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- CRL DP: http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it","email:pupec.informatica.aci.it","email:pro.sicurezzapostale.it","email:pec.bill4me.it","email:pec.notartel.it","email:miapec.it","email:ig-trustmail.com","email:postecertifica.it","email:pec.reevo.eu"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            32:be:16:17:61:d0:8e:b6:a3:b0:d5:47:e8:9c:79:cd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Jan 21 14:32:53 2025 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, L = Roma, O = Agenzia per l'Italia Digitale, CN = AgID CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                CA Issuers - URI:http://cacert.actalis.it/certs/actalis-autroot
                OCSP - URI:http://ocsp07.actalis.it/VA/AUTH-ROOT
            X509v3 Name Constraints:
                Permitted:
                  email:agid.gov.it
                  email:cert.informatica.aci.it
                  email:cert.interno.it
                  email:emarche.it
                  email:fastweb-pec.it
                  email:gestorepec.unina.it
                  email:kmailer.it
                  email:legalmail.it
                  email:pcert.sogei.it
                  email:pec.actalis.it
                  email:pec.ancitel.it
                  email:pec.aruba.it
                  email:pec.basilicatanet.it
                  email:pec-email.com
                  email:pec.postecert.it
                  email:pec.posteitaliane.it
                  email:pec.rupar.puglia.it
                  email:postacert.cedacri.it
                  email:postacertificata.notariato.it
                  email:postacert.it.net
                  email:postecert.it
                  email:sicurezzapostale.it
                  email:telecompost.it
                  email:trustedmail.intesa.it
                  email:twtcert.it
                  email:zucchettipec.it
                  email:cert.intesa.it
                  email:certmail.kpnqwest.it
                  email:certmail.irideos.it
                  email:pupec.informatica.aci.it
                  email:pro.sicurezzapostale.it
                  email:pec.bill4me.it
                  email:pec.notartel.it
                  email:miapec.it
                  email:ig-trustmail.com
                  email:postecertifica.it
                  email:pec.reevo.eu
                  DirName:C = IT, ST = Roma, L = Roma, O = ACI Informatica S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Aruba PEC S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Agenzia per l'Italia Digitale
                  DirName:C = IT, ST = Roma, L = Roma, O = Ancitel S.p.A.
                  DirName:C = IT, ST = Parma, L = Collecchio, O = Cedacri S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Consiglio Nazionale del Notariato
                  DirName:C = IT, ST = Milano, L = Milano, O = Fastweb S.p.A.
                  DirName:C = IT, ST = Milano, L = Assago, O = ITnet S.r.l.
                  DirName:C = IT, ST = Torino, L = Torino, O = In.Te.S.A. S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = InfoCert S.p.A.
                  DirName:C = IT, ST = Bari, L = Valenzano, O = InnovaPuglia S.p.A.
                  DirName:C = IT, ST = Ancona, L = Senigallia, O = Namirial S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Poste Italiane S.p.A.
                  DirName:C = IT, ST = Potenza, L = Potenza, O = Regione Basilicata
                  DirName:C = IT, ST = Ancona, L = Ancona, O = Regione Marche
                  DirName:C = IT, ST = Firenze, L = Firenze, O = Register S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Sogei S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = TWT S.p.A.
                  DirName:C = IT, ST = Roma, L = Pomezia, O = Telecom Italia Trust Technologies S.r.l.
                  DirName:C = IT, ST = Napoli, L = Napoli, O = UNIVERSITA DEGLI STUDI DI NAPOLI FEDERICO II
                  DirName:C = IT, ST = Lodi, L = Lodi, O = Zucchetti S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = KPNQWEST ITALIA S.r.l.
                  DirName:C = IT, ST = Milano, L = Milano, O = IRIDEOS S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Notartel S.p.A.
                  DirName:C = IT, ST = Torino, L = Torino, O = Telsy S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = Intesi Group S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Postel S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = ReeVo S.p.A.
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
                  DNS:
            X509v3 Certificate Policies:
                Policy: 1.3.76.16.3.1
                  CPS: http://www.agid.gov.it/certificati-firma-pec
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                A5:FD:85:05:0E:C3:F1:D6:65:4A:20:6C:E2:DB:4D:60:93:2B:8A:A0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0E19FD9967322133BD7A173B4851A90F3FC575A98507113D86C4D5EFE361B06E
    SPKI SHA256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: http://cacert.actalis.it/certs/actalis-autroot
- CRL Distribution Points: http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it","email:pupec.informatica.aci.it","email:pro.sicurezzapostale.it","email:pec.bill4me.it","email:pec.notartel.it","email:miapec.it","email:ig-trustmail.com","email:postecertifica.it","email:pec.reevo.eu"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### AgID CA1

- Subject: countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 3030D5736412E5CEC6D0D0AF9A68A994
- SHA-256: D793D934DD1B9FF9F6A76D438C760ED44B72BCDE660B49A77DBCF81EC7CEB3A9
- SPKI SHA-256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
- Validity: 2020-01-30 to 2030-01-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://ca1.agid.gov.it/CRL
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it","email:pupec.informatica.aci.it","email:pro.sicurezzapostale.it","email:pec.bill4me.it","email:pec.notartel.it","email:miapec.it"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            30:30:d5:73:64:12:e5:ce:c6:d0:d0:af:9a:68:a9:94
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Jan 30 07:19:47 2020 GMT
            Not After : Jan 29 07:19:47 2030 GMT
        Subject: C = IT, L = Roma, O = Agenzia per l'Italia Digitale, OU = Area Soluzioni per la Pubblica Amministrazione, CN = AgID CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                OCSP - URI:http://ocsp07.actalis.it/VA/AUTH-ROOT
            X509v3 Name Constraints:
                Permitted:
                  email:agid.gov.it
                  email:cert.informatica.aci.it
                  email:cert.interno.it
                  email:emarche.it
                  email:fastweb-pec.it
                  email:gestorepec.unina.it
                  email:kmailer.it
                  email:legalmail.it
                  email:pcert.sogei.it
                  email:pec.actalis.it
                  email:pec.ancitel.it
                  email:pec.aruba.it
                  email:pec.basilicatanet.it
                  email:pec-email.com
                  email:pec.postecert.it
                  email:pec.posteitaliane.it
                  email:pec.rupar.puglia.it
                  email:postacert.cedacri.it
                  email:postacertificata.notariato.it
                  email:postacert.it.net
                  email:postecert.it
                  email:sicurezzapostale.it
                  email:telecompost.it
                  email:trustedmail.intesa.it
                  email:twtcert.it
                  email:zucchettipec.it
                  email:cert.intesa.it
                  email:certmail.kpnqwest.it
                  email:certmail.irideos.it
                  email:pupec.informatica.aci.it
                  email:pro.sicurezzapostale.it
                  email:pec.bill4me.it
                  email:pec.notartel.it
                  email:miapec.it
                  DNS:agendadigitale.it
                  DNS:agid-ca1-test.it
                  DNS:agid.it
                  DNS:aipa.it
                  DNS:cert-spc.it
                  DNS:crcitalia.it
                  DNS:difensorecivicodigitale.it
                  DNS:digitalagenda.it
                  DNS:digitpa.it
                  DNS:gov.it
                  DNS:italia.it
                  DNS:cnipa.it
                  DNS:cert-pa.it
                  DNS:indicepa.it
                  DirName:C = IT, ST = Roma, L = Roma, O = ACI Informatica S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Aruba PEC S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Agenzia per l'Italia Digitale
                  DirName:C = IT, ST = Roma, L = Roma, O = Ancitel S.p.A.
                  DirName:C = IT, ST = Parma, L = Collecchio, O = Cedacri S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Consiglio Nazionale del Notariato
                  DirName:C = IT, ST = Milano, L = Milano, O = Fastweb S.p.A.
                  DirName:C = IT, ST = Milano, L = Assago, O = ITnet S.r.l.
                  DirName:C = IT, ST = Torino, L = Torino, O = In.Te.S.A. S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = InfoCert S.p.A.
                  DirName:C = IT, ST = Bari, L = Valenzano, O = InnovaPuglia S.p.A.
                  DirName:C = IT, ST = Ancona, L = Senigallia, O = Namirial S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Poste Italiane S.p.A.
                  DirName:C = IT, ST = Potenza, L = Potenza, O = Regione Basilicata
                  DirName:C = IT, ST = Ancona, L = Ancona, O = Regione Marche
                  DirName:C = IT, ST = Firenze, L = Firenze, O = Register S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Sogei S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = TWT S.p.A.
                  DirName:C = IT, ST = Roma, L = Pomezia, O = Telecom Italia Trust Technologies S.r.l.
                  DirName:C = IT, ST = Napoli, L = Napoli, O = UNIVERSITA DEGLI STUDI DI NAPOLI FEDERICO II
                  DirName:C = IT, ST = Lodi, L = Lodi, O = Zucchetti S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = KPNQWEST ITALIA S.r.l.
                  DirName:C = IT, ST = Milano, L = Milano, O = IRIDEOS S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Notartel S.p.A.
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 Certificate Policies:
                Policy: 1.3.76.16.3.1
                  CPS: http://www.agid.gov.it/certificati-firma-pec
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                A5:FD:85:05:0E:C3:F1:D6:65:4A:20:6C:E2:DB:4D:60:93:2B:8A:A0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D793D934DD1B9FF9F6A76D438C760ED44B72BCDE660B49A77DBCF81EC7CEB3A9
    SPKI SHA256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it","email:pupec.informatica.aci.it","email:pro.sicurezzapostale.it","email:pec.bill4me.it","email:pec.notartel.it","email:miapec.it"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### AgID CA1

- Subject: countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 2FE0C106450ED3680C51029C8C54125D
- SHA-256: E7FA0F67C9B6D886C868408996DBDFC3680E8B9EC47628EEFB4824C23A287693
- SPKI SHA-256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
- Validity: 2019-06-13 to 2029-06-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://ca1.agid.gov.it/CRL
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it","email:pupec.informatica.aci.it","email:pro.sicurezzapostale.it","email:pec.bill4me.it","email:pec.notartel.it"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2f:e0:c1:06:45:0e:d3:68:0c:51:02:9c:8c:54:12:5d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Jun 13 07:48:47 2019 GMT
            Not After : Jun 12 07:48:47 2029 GMT
        Subject: C = IT, L = Roma, O = Agenzia per l'Italia Digitale, OU = Area Soluzioni per la Pubblica Amministrazione, CN = AgID CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Name Constraints:
                Permitted:
                  email:agid.gov.it
                  email:cert.informatica.aci.it
                  email:cert.interno.it
                  email:emarche.it
                  email:fastweb-pec.it
                  email:gestorepec.unina.it
                  email:kmailer.it
                  email:legalmail.it
                  email:pcert.sogei.it
                  email:pec.actalis.it
                  email:pec.ancitel.it
                  email:pec.aruba.it
                  email:pec.basilicatanet.it
                  email:pec-email.com
                  email:pec.postecert.it
                  email:pec.posteitaliane.it
                  email:pec.rupar.puglia.it
                  email:postacert.cedacri.it
                  email:postacertificata.notariato.it
                  email:postacert.it.net
                  email:postecert.it
                  email:sicurezzapostale.it
                  email:telecompost.it
                  email:trustedmail.intesa.it
                  email:twtcert.it
                  email:zucchettipec.it
                  email:cert.intesa.it
                  email:certmail.kpnqwest.it
                  email:certmail.irideos.it
                  email:pupec.informatica.aci.it
                  email:pro.sicurezzapostale.it
                  email:pec.bill4me.it
                  email:pec.notartel.it
                  DNS:agendadigitale.it
                  DNS:agid-ca1-test.it
                  DNS:agid.it
                  DNS:aipa.it
                  DNS:cert-spc.it
                  DNS:crcitalia.it
                  DNS:difensorecivicodigitale.it
                  DNS:digitalagenda.it
                  DNS:digitpa.it
                  DNS:gov.it
                  DNS:italia.it
                  DNS:cnipa.it
                  DNS:cert-pa.it
                  DNS:indicepa.it
                  DirName:C = IT, ST = Roma, L = Roma, O = ACI Informatica S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Aruba PEC S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Agenzia per l'Italia Digitale
                  DirName:C = IT, ST = Roma, L = Roma, O = Ancitel S.p.A.
                  DirName:C = IT, ST = Parma, L = Collecchio, O = Cedacri S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Consiglio Nazionale del Notariato
                  DirName:C = IT, ST = Milano, L = Milano, O = Fastweb S.p.A.
                  DirName:C = IT, ST = Milano, L = Assago, O = ITnet S.r.l.
                  DirName:C = IT, ST = Torino, L = Torino, O = In.Te.S.A. S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = InfoCert S.p.A.
                  DirName:C = IT, ST = Bari, L = Valenzano, O = InnovaPuglia S.p.A.
                  DirName:C = IT, ST = Ancona, L = Senigallia, O = Namirial S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Poste Italiane S.p.A.
                  DirName:C = IT, ST = Potenza, L = Potenza, O = Regione Basilicata
                  DirName:C = IT, ST = Ancona, L = Ancona, O = Regione Marche
                  DirName:C = IT, ST = Firenze, L = Firenze, O = Register S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Sogei S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = TWT S.p.A.
                  DirName:C = IT, ST = Roma, L = Pomezia, O = Telecom Italia Trust Technologies S.r.l.
                  DirName:C = IT, ST = Napoli, L = Napoli, O = UNIVERSITA DEGLI STUDI DI NAPOLI FEDERICO II
                  DirName:C = IT, ST = Lodi, L = Lodi, O = Zucchetti S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = KPNQWEST ITALIA S.r.l.
                  DirName:C = IT, ST = Milano, L = Milano, O = IRIDEOS S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Notartel S.p.A.
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            Authority Information Access:
                OCSP - URI:http://ocsp07.actalis.it/VA/AUTH-ROOT
            X509v3 Subject Key Identifier:
                A5:FD:85:05:0E:C3:F1:D6:65:4A:20:6C:E2:DB:4D:60:93:2B:8A:A0
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Certificate Policies:
                Policy: 1.3.76.16.3.1
                  CPS: http://www.agid.gov.it/certificati-firma-pec
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, E-mail Protection
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E7FA0F67C9B6D886C868408996DBDFC3680E8B9EC47628EEFB4824C23A287693
    SPKI SHA256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it","email:pupec.informatica.aci.it","email:pro.sicurezzapostale.it","email:pec.bill4me.it","email:pec.notartel.it"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### AgID CA1

- Subject: countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 7DBC9C6155059A871B84C7F7A48B7162
- SHA-256: ADA5A71AF2121B569104BE385E746FA975617E81DBFAF6F722E62352471BD838
- SPKI SHA-256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
- Validity: 2019-04-15 to 2029-04-14
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://ca1.agid.gov.it/CRL
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it","email:pupec.informatica.aci.it","email:pro.sicurezzapostale.it","email:pec.bill4me.it"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:bc:9c:61:55:05:9a:87:1b:84:c7:f7:a4:8b:71:62
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Apr 15 12:36:04 2019 GMT
            Not After : Apr 14 12:36:04 2029 GMT
        Subject: C = IT, L = Roma, O = Agenzia per l'Italia Digitale, OU = Area Soluzioni per la Pubblica Amministrazione, CN = AgID CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Name Constraints:
                Permitted:
                  email:agid.gov.it
                  email:cert.informatica.aci.it
                  email:cert.interno.it
                  email:emarche.it
                  email:fastweb-pec.it
                  email:gestorepec.unina.it
                  email:kmailer.it
                  email:legalmail.it
                  email:pcert.sogei.it
                  email:pec.actalis.it
                  email:pec.ancitel.it
                  email:pec.aruba.it
                  email:pec.basilicatanet.it
                  email:pec-email.com
                  email:pec.postecert.it
                  email:pec.posteitaliane.it
                  email:pec.rupar.puglia.it
                  email:postacert.cedacri.it
                  email:postacertificata.notariato.it
                  email:postacert.it.net
                  email:postecert.it
                  email:sicurezzapostale.it
                  email:telecompost.it
                  email:trustedmail.intesa.it
                  email:twtcert.it
                  email:zucchettipec.it
                  email:cert.intesa.it
                  email:certmail.kpnqwest.it
                  email:certmail.irideos.it
                  email:pupec.informatica.aci.it
                  email:pro.sicurezzapostale.it
                  email:pec.bill4me.it
                  DNS:agendadigitale.it
                  DNS:agid-ca1-test.it
                  DNS:agid.it
                  DNS:aipa.it
                  DNS:cert-spc.it
                  DNS:crcitalia.it
                  DNS:difensorecivicodigitale.it
                  DNS:digitalagenda.it
                  DNS:digitpa.it
                  DNS:gov.it
                  DNS:italia.it
                  DNS:cnipa.it
                  DNS:cert-pa.it
                  DNS:indicepa.it
                  DirName:C = IT, ST = Roma, L = Roma, O = ACI Informatica S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Aruba PEC S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Agenzia per l'Italia Digitale
                  DirName:C = IT, ST = Roma, L = Roma, O = Ancitel S.p.A.
                  DirName:C = IT, ST = Parma, L = Collecchio, O = Cedacri S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Consiglio Nazionale del Notariato
                  DirName:C = IT, ST = Milano, L = Milano, O = Fastweb S.p.A.
                  DirName:C = IT, ST = Milano, L = Assago, O = ITnet S.r.l.
                  DirName:C = IT, ST = Torino, L = Torino, O = In.Te.S.A. S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = InfoCert S.p.A.
                  DirName:C = IT, ST = Bari, L = Valenzano, O = InnovaPuglia S.p.A.
                  DirName:C = IT, ST = Ancona, L = Senigallia, O = Namirial S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Poste Italiane S.p.A.
                  DirName:C = IT, ST = Potenza, L = Potenza, O = Regione Basilicata
                  DirName:C = IT, ST = Ancona, L = Ancona, O = Regione Marche
                  DirName:C = IT, ST = Firenze, L = Firenze, O = Register S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Sogei S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = TWT S.p.A.
                  DirName:C = IT, ST = Roma, L = Pomezia, O = Telecom Italia Trust Technologies S.r.l.
                  DirName:C = IT, ST = Napoli, L = Napoli, O = UNIVERSITA DEGLI STUDI DI NAPOLI FEDERICO II
                  DirName:C = IT, ST = Lodi, L = Lodi, O = Zucchetti S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = KPNQWEST ITALIA S.r.l.
                  DirName:C = IT, ST = Milano, L = Milano, O = IRIDEOS S.p.A.
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            Authority Information Access:
                OCSP - URI:http://ocsp07.actalis.it/VA/AUTH-ROOT
            X509v3 Subject Key Identifier:
                A5:FD:85:05:0E:C3:F1:D6:65:4A:20:6C:E2:DB:4D:60:93:2B:8A:A0
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Certificate Policies:
                Policy: 1.3.76.16.3.1
                  CPS: http://www.agid.gov.it/certificati-firma-pec
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, E-mail Protection
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: ADA5A71AF2121B569104BE385E746FA975617E81DBFAF6F722E62352471BD838
    SPKI SHA256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it","email:pupec.informatica.aci.it","email:pro.sicurezzapostale.it","email:pec.bill4me.it"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### AgID CA1

- Subject: countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 7C9F3DA6DF9E28710F61DEAEB70BA491
- SHA-256: F7B09EEA79096A4498F6A2B8D6F1183228A3769EA988050D1B32A380EABC4F9E
- SPKI SHA-256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
- Validity: 2020-02-19 to 2030-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://ca1.agid.gov.it/CRL
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, TLS Web Server Authentication
- Certificate Policies: 1.3.76.16.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it","email:pupec.informatica.aci.it","email:pro.sicurezzapostale.it","email:pec.bill4me.it","email:pec.notartel.it","email:miapec.it"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:9f:3d:a6:df:9e:28:71:0f:61:de:ae:b7:0b:a4:91
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Feb 19 09:58:32 2020 GMT
            Not After : Feb 18 09:58:32 2030 GMT
        Subject: C = IT, L = Roma, O = Agenzia per l'Italia Digitale, OU = Area Soluzioni per la Pubblica Amministrazione, CN = AgID CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                OCSP - URI:http://ocsp07.actalis.it/VA/AUTH-ROOT
            X509v3 Name Constraints:
                Permitted:
                  email:agid.gov.it
                  email:cert.informatica.aci.it
                  email:cert.interno.it
                  email:emarche.it
                  email:fastweb-pec.it
                  email:gestorepec.unina.it
                  email:kmailer.it
                  email:legalmail.it
                  email:pcert.sogei.it
                  email:pec.actalis.it
                  email:pec.ancitel.it
                  email:pec.aruba.it
                  email:pec.basilicatanet.it
                  email:pec-email.com
                  email:pec.postecert.it
                  email:pec.posteitaliane.it
                  email:pec.rupar.puglia.it
                  email:postacert.cedacri.it
                  email:postacertificata.notariato.it
                  email:postacert.it.net
                  email:postecert.it
                  email:sicurezzapostale.it
                  email:telecompost.it
                  email:trustedmail.intesa.it
                  email:twtcert.it
                  email:zucchettipec.it
                  email:cert.intesa.it
                  email:certmail.kpnqwest.it
                  email:certmail.irideos.it
                  email:pupec.informatica.aci.it
                  email:pro.sicurezzapostale.it
                  email:pec.bill4me.it
                  email:pec.notartel.it
                  email:miapec.it
                  DNS:agendadigitale.it
                  DNS:agid-ca1-test.it
                  DNS:agid.it
                  DNS:aipa.it
                  DNS:cert-spc.it
                  DNS:crcitalia.it
                  DNS:difensorecivicodigitale.it
                  DNS:digitalagenda.it
                  DNS:digitpa.it
                  DNS:gov.it
                  DNS:italia.it
                  DNS:cnipa.it
                  DNS:cert-pa.it
                  DNS:indicepa.it
                  DirName:C = IT, ST = Roma, L = Roma, O = ACI Informatica S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Aruba PEC S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Agenzia per l'Italia Digitale
                  DirName:C = IT, ST = Roma, L = Roma, O = Ancitel S.p.A.
                  DirName:C = IT, ST = Parma, L = Collecchio, O = Cedacri S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Consiglio Nazionale del Notariato
                  DirName:C = IT, ST = Milano, L = Milano, O = Fastweb S.p.A.
                  DirName:C = IT, ST = Milano, L = Assago, O = ITnet S.r.l.
                  DirName:C = IT, ST = Torino, L = Torino, O = In.Te.S.A. S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = InfoCert S.p.A.
                  DirName:C = IT, ST = Bari, L = Valenzano, O = InnovaPuglia S.p.A.
                  DirName:C = IT, ST = Ancona, L = Senigallia, O = Namirial S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Poste Italiane S.p.A.
                  DirName:C = IT, ST = Potenza, L = Potenza, O = Regione Basilicata
                  DirName:C = IT, ST = Ancona, L = Ancona, O = Regione Marche
                  DirName:C = IT, ST = Firenze, L = Firenze, O = Register S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Sogei S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = TWT S.p.A.
                  DirName:C = IT, ST = Roma, L = Pomezia, O = Telecom Italia Trust Technologies S.r.l.
                  DirName:C = IT, ST = Napoli, L = Napoli, O = UNIVERSITA DEGLI STUDI DI NAPOLI FEDERICO II
                  DirName:C = IT, ST = Lodi, L = Lodi, O = Zucchetti S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = KPNQWEST ITALIA S.r.l.
                  DirName:C = IT, ST = Milano, L = Milano, O = IRIDEOS S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Notartel S.p.A.
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 Certificate Policies:
                Policy: 1.3.76.16.3.1
                  CPS: http://www.agid.gov.it/certificati-firma-pec
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                A5:FD:85:05:0E:C3:F1:D6:65:4A:20:6C:E2:DB:4D:60:93:2B:8A:A0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F7B09EEA79096A4498F6A2B8D6F1183228A3769EA988050D1B32A380EABC4F9E
    SPKI SHA256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, TLS Web Server Authentication
- Certificate Policies: 1.3.76.16.3.1
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it","email:pupec.informatica.aci.it","email:pro.sicurezzapostale.it","email:pec.bill4me.it","email:pec.notartel.it","email:miapec.it"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### AgID CA1

- Subject: countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 459732D8F318CB7593A2F4680F90EAD9
- SHA-256: 404A2B23B25200446CA7213E1AF56635CB93DDF7BEF0D87664BA411B7F4C8E56
- SPKI SHA-256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
- Validity: 2020-10-13 to 2030-09-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://ca1.agid.gov.it/CRL
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, TLS Web Server Authentication
- Certificate Policies: 1.3.76.16.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it","email:pupec.informatica.aci.it","email:pro.sicurezzapostale.it","email:pec.bill4me.it","email:pec.notartel.it","email:miapec.it"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:97:32:d8:f3:18:cb:75:93:a2:f4:68:0f:90:ea:d9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Oct 13 06:10:10 2020 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, L = Roma, O = Agenzia per l'Italia Digitale, OU = Area Soluzioni per la Pubblica Amministrazione, CN = AgID CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                OCSP - URI:http://ocsp07.actalis.it/VA/AUTH-ROOT
            X509v3 Name Constraints:
                Permitted:
                  email:agid.gov.it
                  email:cert.informatica.aci.it
                  email:cert.interno.it
                  email:emarche.it
                  email:fastweb-pec.it
                  email:gestorepec.unina.it
                  email:kmailer.it
                  email:legalmail.it
                  email:pcert.sogei.it
                  email:pec.actalis.it
                  email:pec.ancitel.it
                  email:pec.aruba.it
                  email:pec.basilicatanet.it
                  email:pec-email.com
                  email:pec.postecert.it
                  email:pec.posteitaliane.it
                  email:pec.rupar.puglia.it
                  email:postacert.cedacri.it
                  email:postacertificata.notariato.it
                  email:postacert.it.net
                  email:postecert.it
                  email:sicurezzapostale.it
                  email:telecompost.it
                  email:trustedmail.intesa.it
                  email:twtcert.it
                  email:zucchettipec.it
                  email:cert.intesa.it
                  email:certmail.kpnqwest.it
                  email:certmail.irideos.it
                  email:pupec.informatica.aci.it
                  email:pro.sicurezzapostale.it
                  email:pec.bill4me.it
                  email:pec.notartel.it
                  email:miapec.it
                  DNS:agendadigitale.it
                  DNS:agid-ca1-test.it
                  DNS:agid.it
                  DNS:aipa.it
                  DNS:cert-spc.it
                  DNS:crcitalia.it
                  DNS:difensorecivicodigitale.it
                  DNS:digitalagenda.it
                  DNS:digitpa.it
                  DNS:gov.it
                  DNS:italia.it
                  DNS:cnipa.it
                  DNS:cert-pa.it
                  DNS:indicepa.it
                  DirName:C = IT, ST = Roma, L = Roma, O = ACI Informatica S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Aruba PEC S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Agenzia per l'Italia Digitale
                  DirName:C = IT, ST = Roma, L = Roma, O = Ancitel S.p.A.
                  DirName:C = IT, ST = Parma, L = Collecchio, O = Cedacri S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Consiglio Nazionale del Notariato
                  DirName:C = IT, ST = Milano, L = Milano, O = Fastweb S.p.A.
                  DirName:C = IT, ST = Milano, L = Assago, O = ITnet S.r.l.
                  DirName:C = IT, ST = Torino, L = Torino, O = In.Te.S.A. S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = InfoCert S.p.A.
                  DirName:C = IT, ST = Bari, L = Valenzano, O = InnovaPuglia S.p.A.
                  DirName:C = IT, ST = Ancona, L = Senigallia, O = Namirial S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Poste Italiane S.p.A.
                  DirName:C = IT, ST = Potenza, L = Potenza, O = Regione Basilicata
                  DirName:C = IT, ST = Ancona, L = Ancona, O = Regione Marche
                  DirName:C = IT, ST = Firenze, L = Firenze, O = Register S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Sogei S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = TWT S.p.A.
                  DirName:C = IT, ST = Roma, L = Pomezia, O = Telecom Italia Trust Technologies S.r.l.
                  DirName:C = IT, ST = Napoli, L = Napoli, O = UNIVERSITA DEGLI STUDI DI NAPOLI FEDERICO II
                  DirName:C = IT, ST = Lodi, L = Lodi, O = Zucchetti S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = KPNQWEST ITALIA S.r.l.
                  DirName:C = IT, ST = Milano, L = Milano, O = IRIDEOS S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Notartel S.p.A.
                  DirName:C = IT, ST = Torino, L = Torino, O = Telsy S.p.A.
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 Certificate Policies:
                Policy: 1.3.76.16.3.1
                  CPS: http://www.agid.gov.it/certificati-firma-pec
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                A5:FD:85:05:0E:C3:F1:D6:65:4A:20:6C:E2:DB:4D:60:93:2B:8A:A0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 404A2B23B25200446CA7213E1AF56635CB93DDF7BEF0D87664BA411B7F4C8E56
    SPKI SHA256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, TLS Web Server Authentication
- Certificate Policies: 1.3.76.16.3.1
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it","email:pupec.informatica.aci.it","email:pro.sicurezzapostale.it","email:pec.bill4me.it","email:pec.notartel.it","email:miapec.it"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ca_invalid_eku: emailProtection%s MUST not be present together with serverAuth in the EKU extension
- [historical] error e_ext_name_constraints_not_critical: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### AgID CA1

- Subject: countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 5E3824E82DA9BA7C634FBD485AAA302D
- SHA-256: 790EC428504A61F273E4FCF7FFD4D56991EDC02D4402FBBD8914E149FA278C1D
- SPKI SHA-256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
- Validity: 2025-02-20 to 2030-09-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v10.0_en_20260716.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://ca1.agid.gov.it/CRL
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- CRL DP: http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it","email:pupec.informatica.aci.it","email:pro.sicurezzapostale.it","email:pec.bill4me.it","email:pec.notartel.it","email:miapec.it","email:ig-trustmail.com","email:postecertifica.it","email:pec.reevo.eu"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5e:38:24:e8:2d:a9:ba:7c:63:4f:bd:48:5a:aa:30:2d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Feb 20 14:57:40 2025 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, L = Roma, O = Agenzia per l'Italia Digitale, OU = Area Soluzioni per la Pubblica Amministrazione, CN = AgID CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                CA Issuers - URI:http://cacert.actalis.it/certs/actalis-autroot
                OCSP - URI:http://ocsp07.actalis.it/VA/AUTH-ROOT
            X509v3 Name Constraints:
                Permitted:
                  email:agid.gov.it
                  email:cert.informatica.aci.it
                  email:cert.interno.it
                  email:emarche.it
                  email:fastweb-pec.it
                  email:gestorepec.unina.it
                  email:kmailer.it
                  email:legalmail.it
                  email:pcert.sogei.it
                  email:pec.actalis.it
                  email:pec.ancitel.it
                  email:pec.aruba.it
                  email:pec.basilicatanet.it
                  email:pec-email.com
                  email:pec.postecert.it
                  email:pec.posteitaliane.it
                  email:pec.rupar.puglia.it
                  email:postacert.cedacri.it
                  email:postacertificata.notariato.it
                  email:postacert.it.net
                  email:postecert.it
                  email:sicurezzapostale.it
                  email:telecompost.it
                  email:trustedmail.intesa.it
                  email:twtcert.it
                  email:zucchettipec.it
                  email:cert.intesa.it
                  email:certmail.kpnqwest.it
                  email:certmail.irideos.it
                  email:pupec.informatica.aci.it
                  email:pro.sicurezzapostale.it
                  email:pec.bill4me.it
                  email:pec.notartel.it
                  email:miapec.it
                  email:ig-trustmail.com
                  email:postecertifica.it
                  email:pec.reevo.eu
                  DirName:C = IT, ST = Roma, L = Roma, O = ACI Informatica S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Aruba PEC S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Agenzia per l'Italia Digitale
                  DirName:C = IT, ST = Roma, L = Roma, O = Ancitel S.p.A.
                  DirName:C = IT, ST = Parma, L = Collecchio, O = Cedacri S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Consiglio Nazionale del Notariato
                  DirName:C = IT, ST = Milano, L = Milano, O = Fastweb S.p.A.
                  DirName:C = IT, ST = Milano, L = Assago, O = ITnet S.r.l.
                  DirName:C = IT, ST = Torino, L = Torino, O = In.Te.S.A. S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = InfoCert S.p.A.
                  DirName:C = IT, ST = Bari, L = Valenzano, O = InnovaPuglia S.p.A.
                  DirName:C = IT, ST = Ancona, L = Senigallia, O = Namirial S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Poste Italiane S.p.A.
                  DirName:C = IT, ST = Potenza, L = Potenza, O = Regione Basilicata
                  DirName:C = IT, ST = Ancona, L = Ancona, O = Regione Marche
                  DirName:C = IT, ST = Firenze, L = Firenze, O = Register S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Sogei S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = TWT S.p.A.
                  DirName:C = IT, ST = Roma, L = Pomezia, O = Telecom Italia Trust Technologies S.r.l.
                  DirName:C = IT, ST = Napoli, L = Napoli, O = UNIVERSITA DEGLI STUDI DI NAPOLI FEDERICO II
                  DirName:C = IT, ST = Lodi, L = Lodi, O = Zucchetti S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = KPNQWEST ITALIA S.r.l.
                  DirName:C = IT, ST = Milano, L = Milano, O = IRIDEOS S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Notartel S.p.A.
                  DirName:C = IT, ST = Torino, L = Torino, O = Telsy S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = Intesi Group S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Postel S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = ReeVo S.p.A.
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
                  DNS:
            X509v3 Certificate Policies:
                Policy: 1.3.76.16.3.1
                  CPS: http://www.agid.gov.it/certificati-firma-pec
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                A5:FD:85:05:0E:C3:F1:D6:65:4A:20:6C:E2:DB:4D:60:93:2B:8A:A0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 790EC428504A61F273E4FCF7FFD4D56991EDC02D4402FBBD8914E149FA278C1D
    SPKI SHA256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: http://cacert.actalis.it/certs/actalis-autroot
- CRL Distribution Points: http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it","email:pupec.informatica.aci.it","email:pro.sicurezzapostale.it","email:pec.bill4me.it","email:pec.notartel.it","email:miapec.it","email:ig-trustmail.com","email:postecertifica.it","email:pec.reevo.eu"],"excluded":[]}

#### zlint Findings


- [current] error e_ext_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### AgID CA1

- Subject: countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 25FA23DF50834CA1D6A8AFAB9D87DBB7
- SHA-256: 68868C3326EDB4865284EE123AACBA98EE634BDC28B443DBB234884A7BB7DBA5
- SPKI SHA-256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
- Validity: 2023-12-13 to 2030-09-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v8.0.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://ca1.agid.gov.it/CRL
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it","email:pupec.informatica.aci.it","email:pro.sicurezzapostale.it","email:pec.bill4me.it","email:pec.notartel.it","email:miapec.it","email:ig-trustmail.com","email:postecertifica.it"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            25:fa:23:df:50:83:4c:a1:d6:a8:af:ab:9d:87:db:b7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Dec 13 13:22:08 2023 GMT
            Not After : Sep 22 11:22:02 2030 GMT
        Subject: C = IT, L = Roma, O = Agenzia per l'Italia Digitale, OU = Area Soluzioni per la Pubblica Amministrazione, CN = AgID CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            Authority Information Access:
                CA Issuers - URI:http://cacert.actalis.it/certs/actalis-autroot
                OCSP - URI:http://ocsp07.actalis.it/VA/AUTH-ROOT
            X509v3 Name Constraints:
                Permitted:
                  email:agid.gov.it
                  email:cert.informatica.aci.it
                  email:cert.interno.it
                  email:emarche.it
                  email:fastweb-pec.it
                  email:gestorepec.unina.it
                  email:kmailer.it
                  email:legalmail.it
                  email:pcert.sogei.it
                  email:pec.actalis.it
                  email:pec.ancitel.it
                  email:pec.aruba.it
                  email:pec.basilicatanet.it
                  email:pec-email.com
                  email:pec.postecert.it
                  email:pec.posteitaliane.it
                  email:pec.rupar.puglia.it
                  email:postacert.cedacri.it
                  email:postacertificata.notariato.it
                  email:postacert.it.net
                  email:postecert.it
                  email:sicurezzapostale.it
                  email:telecompost.it
                  email:trustedmail.intesa.it
                  email:twtcert.it
                  email:zucchettipec.it
                  email:cert.intesa.it
                  email:certmail.kpnqwest.it
                  email:certmail.irideos.it
                  email:pupec.informatica.aci.it
                  email:pro.sicurezzapostale.it
                  email:pec.bill4me.it
                  email:pec.notartel.it
                  email:miapec.it
                  email:ig-trustmail.com
                  email:postecertifica.it
                  DirName:C = IT, ST = Roma, L = Roma, O = ACI Informatica S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Aruba PEC S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Agenzia per l'Italia Digitale
                  DirName:C = IT, ST = Roma, L = Roma, O = Ancitel S.p.A.
                  DirName:C = IT, ST = Parma, L = Collecchio, O = Cedacri S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Consiglio Nazionale del Notariato
                  DirName:C = IT, ST = Milano, L = Milano, O = Fastweb S.p.A.
                  DirName:C = IT, ST = Milano, L = Assago, O = ITnet S.r.l.
                  DirName:C = IT, ST = Torino, L = Torino, O = In.Te.S.A. S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = InfoCert S.p.A.
                  DirName:C = IT, ST = Bari, L = Valenzano, O = InnovaPuglia S.p.A.
                  DirName:C = IT, ST = Ancona, L = Senigallia, O = Namirial S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Poste Italiane S.p.A.
                  DirName:C = IT, ST = Potenza, L = Potenza, O = Regione Basilicata
                  DirName:C = IT, ST = Ancona, L = Ancona, O = Regione Marche
                  DirName:C = IT, ST = Firenze, L = Firenze, O = Register S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Sogei S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = TWT S.p.A.
                  DirName:C = IT, ST = Roma, L = Pomezia, O = Telecom Italia Trust Technologies S.r.l.
                  DirName:C = IT, ST = Napoli, L = Napoli, O = UNIVERSITA DEGLI STUDI DI NAPOLI FEDERICO II
                  DirName:C = IT, ST = Lodi, L = Lodi, O = Zucchetti S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = KPNQWEST ITALIA S.r.l.
                  DirName:C = IT, ST = Milano, L = Milano, O = IRIDEOS S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Notartel S.p.A.
                  DirName:C = IT, ST = Torino, L = Torino, O = Telsy S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = Intesi Group S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Postel S.p.A.
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 Certificate Policies:
                Policy: 1.3.76.16.3.1
                  CPS: http://www.agid.gov.it/certificati-firma-pec
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Subject Key Identifier:
                A5:FD:85:05:0E:C3:F1:D6:65:4A:20:6C:E2:DB:4D:60:93:2B:8A:A0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 68868C3326EDB4865284EE123AACBA98EE634BDC28B443DBB234884A7BB7DBA5
    SPKI SHA256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: http://cacert.actalis.it/certs/actalis-autroot
- CRL Distribution Points: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it","email:pupec.informatica.aci.it","email:pro.sicurezzapostale.it","email:pec.bill4me.it","email:pec.notartel.it","email:miapec.it","email:ig-trustmail.com","email:postecertifica.it"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### AgID CA1

- Subject: countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 241C170B2464E018
- SHA-256: 6018F0DFFAA4D48F6B363DBD895B43D720691F9658E3D940727FB1499D525005
- SPKI SHA-256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
- Validity: 2018-11-22 to 2028-11-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v6.0_del_29-11-2021.pdf, https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v6.0_del_29-11-2021.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://ca1.agid.gov.it/CRL
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2601980021335973912 (0x241c170b2464e018)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Nov 22 08:01:13 2018 GMT
            Not After : Nov 21 08:01:13 2028 GMT
        Subject: C = IT, L = Roma, O = Agenzia per l'Italia Digitale, OU = Area Soluzioni per la Pubblica Amministrazione, CN = AgID CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Name Constraints:
                Permitted:
                  email:agid.gov.it
                  email:cert.informatica.aci.it
                  email:cert.interno.it
                  email:emarche.it
                  email:fastweb-pec.it
                  email:gestorepec.unina.it
                  email:kmailer.it
                  email:legalmail.it
                  email:pcert.sogei.it
                  email:pec.actalis.it
                  email:pec.ancitel.it
                  email:pec.aruba.it
                  email:pec.basilicatanet.it
                  email:pec-email.com
                  email:pec.postecert.it
                  email:pec.posteitaliane.it
                  email:pec.rupar.puglia.it
                  email:postacert.cedacri.it
                  email:postacertificata.notariato.it
                  email:postacert.it.net
                  email:postecert.it
                  email:sicurezzapostale.it
                  email:telecompost.it
                  email:trustedmail.intesa.it
                  email:twtcert.it
                  email:zucchettipec.it
                  email:cert.intesa.it
                  email:certmail.kpnqwest.it
                  email:certmail.irideos.it
                  DNS:agendadigitale.it
                  DNS:agid-ca1-test.it
                  DNS:agid.it
                  DNS:aipa.it
                  DNS:cert-spc.it
                  DNS:crcitalia.it
                  DNS:difensorecivicodigitale.it
                  DNS:digitalagenda.it
                  DNS:digitpa.it
                  DNS:gov.it
                  DNS:italia.it
                  DNS:cnipa.it
                  DNS:cert-pa.it
                  DNS:indicepa.it
                  DirName:C = IT, ST = Roma, L = Roma, O = ACI Informatica S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Aruba PEC S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Agenzia per l'Italia Digitale
                  DirName:C = IT, ST = Roma, L = Roma, O = Ancitel S.p.A.
                  DirName:C = IT, ST = Parma, L = Collecchio, O = Cedacri S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Consiglio Nazionale del Notariato
                  DirName:C = IT, ST = Milano, L = Milano, O = Fastweb S.p.A.
                  DirName:C = IT, ST = Milano, L = Assago, O = ITnet S.r.l.
                  DirName:C = IT, ST = Torino, L = Torino, O = In.Te.S.A. S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = InfoCert S.p.A.
                  DirName:C = IT, ST = Bari, L = Valenzano, O = InnovaPuglia S.p.A.
                  DirName:C = IT, ST = Ancona, L = Senigallia, O = Namirial S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Poste Italiane S.p.A.
                  DirName:C = IT, ST = Potenza, L = Potenza, O = Regione Basilicata
                  DirName:C = IT, ST = Ancona, L = Ancona, O = Regione Marche
                  DirName:C = IT, ST = Firenze, L = Firenze, O = Register.it S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Sogei S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = TWT S.p.A.
                  DirName:C = IT, ST = Roma, L = Pomezia, O = Telecom Italia Trust Technologies S.r.l.
                  DirName:C = IT, ST = Napoli, L = Napoli, O = UNIVERSITA DEGLI STUDI DI NAPOLI FEDERICO II
                  DirName:C = IT, ST = Lodi, L = Lodi, O = Zucchetti S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = KPNQWEST ITALIA S.r.l.
                  DirName:C = IT, ST = Milano, L = Milano, O = IRIDEOS S.p.A.
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            Authority Information Access:
                OCSP - URI:http://ocsp07.actalis.it/VA/AUTH-ROOT
            X509v3 Subject Key Identifier:
                A5:FD:85:05:0E:C3:F1:D6:65:4A:20:6C:E2:DB:4D:60:93:2B:8A:A0
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Certificate Policies:
                Policy: 1.3.76.16.3.1
                  CPS: http://www.agid.gov.it/certificati-firma-pec
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, E-mail Protection
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6018F0DFFAA4D48F6B363DBD895B43D720691F9658E3D940727FB1499D525005
    SPKI SHA256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### AgID CA1

- Subject: countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 4988021FA535F86A
- SHA-256: 9271CA7E88CED25ED1D1F8E08AFA03B11D1FE12ED1125585ADA501243E2CAC09
- SPKI SHA-256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
- Validity: 2018-07-11 to 2028-07-10
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v6.0_del_29-11-2021.pdf, https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v6.0_del_29-11-2021.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://ca1.agid.gov.it/CRL
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5298487296540407914 (0x4988021fa535f86a)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Jul 11 10:03:14 2018 GMT
            Not After : Jul 10 10:03:14 2028 GMT
        Subject: C = IT, L = Roma, O = Agenzia per l'Italia Digitale, OU = Area Soluzioni per la Pubblica Amministrazione, CN = AgID CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Name Constraints:
                Permitted:
                  email:agid.gov.it
                  email:cert.informatica.aci.it
                  email:cert.interno.it
                  email:emarche.it
                  email:fastweb-pec.it
                  email:gestorepec.unina.it
                  email:kmailer.it
                  email:legalmail.it
                  email:pcert.sogei.it
                  email:pec.actalis.it
                  email:pec.ancitel.it
                  email:pec.aruba.it
                  email:pec.basilicatanet.it
                  email:pec-email.com
                  email:pec.postecert.it
                  email:pec.posteitaliane.it
                  email:pec.rupar.puglia.it
                  email:postacert.cedacri.it
                  email:postacertificata.notariato.it
                  email:postacert.it.net
                  email:postecert.it
                  email:sicurezzapostale.it
                  email:telecompost.it
                  email:trustedmail.intesa.it
                  email:twtcert.it
                  email:zucchettipec.it
                  email:cert.intesa.it
                  email:certmail.kpnqwest.it
                  email:certmail.irideos.it
                  DNS:agid-ca1-test.it
                  DNS:agid.gov.it
                  DNS:avanzamentodigitale.italia.it
                  DNS:cert-pa.it
                  DNS:cnipa.it
                  DNS:fascicolosanitario.gov.it
                  DNS:indicepa.it
                  DNS:indicepa.gov.it
                  DNS:pagopa.gov.it
                  DNS:postacertificata.gov.it
                  DNS:rndt.gov.it
                  DNS:spcoop.gov.it
                  DNS:spid.gov.it
                  DNS:icspc.gov.it
                  DNS:dati.gov.it
                  DNS:geodati.gov.it
                  DirName:C = IT, ST = Roma, L = Roma, O = ACI Informatica S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Aruba PEC S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Agenzia per l'Italia Digitale
                  DirName:C = IT, ST = Roma, L = Roma, O = Ancitel S.p.A.
                  DirName:C = IT, ST = Parma, L = Collecchio, O = Cedacri S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Consiglio Nazionale del Notariato
                  DirName:C = IT, ST = Milano, L = Milano, O = Fastweb S.p.A.
                  DirName:C = IT, ST = Milano, L = Assago, O = ITnet S.r.l.
                  DirName:C = IT, ST = Torino, L = Torino, O = In.Te.S.A. S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = InfoCert S.p.A.
                  DirName:C = IT, ST = Bari, L = Valenzano, O = InnovaPuglia S.p.A.
                  DirName:C = IT, ST = Ancona, L = Senigallia, O = Namirial S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Poste Italiane S.p.A.
                  DirName:C = IT, ST = Potenza, L = Potenza, O = Regione Basilicata
                  DirName:C = IT, ST = Ancona, L = Ancona, O = Regione Marche
                  DirName:C = IT, ST = Firenze, L = Firenze, O = Register.it S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Sogei S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = TWT S.p.A.
                  DirName:C = IT, ST = Roma, L = Pomezia, O = Telecom Italia Trust Technologies S.r.l.
                  DirName:C = IT, ST = Napoli, L = Napoli, O = UNIVERSITA DEGLI STUDI DI NAPOLI FEDERICO II
                  DirName:C = IT, ST = Lodi, L = Lodi, O = Zucchetti S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = KPNQWEST ITALIA S.r.l.
                  DirName:C = IT, ST = Milano, L = Milano, O = IRIDEOS S.p.A.
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            Authority Information Access:
                OCSP - URI:http://ocsp07.actalis.it/VA/AUTH-ROOT
            X509v3 Subject Key Identifier:
                A5:FD:85:05:0E:C3:F1:D6:65:4A:20:6C:E2:DB:4D:60:93:2B:8A:A0
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Certificate Policies:
                Policy: 1.3.76.16.3.1
                  CPS: http://www.agid.gov.it/certificati-firma-pec
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, E-mail Protection
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9271CA7E88CED25ED1D1F8E08AFA03B11D1FE12ED1125585ADA501243E2CAC09
    SPKI SHA256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it","email:certmail.irideos.it"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### AgID CA1

- Subject: countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 6C718AA1D684ECA6
- SHA-256: 728DAF406FDA9ECD4D555DC12F27D67D6DE44524695464A120669200F20B284B
- SPKI SHA-256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
- Validity: 2018-06-20 to 2028-06-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v6.0_del_29-11-2021.pdf, https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v6.0_del_29-11-2021.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://ca1.agid.gov.it/CRL
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7814179256157924518 (0x6c718aa1d684eca6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Jun 20 08:36:38 2018 GMT
            Not After : Jun 19 08:36:38 2028 GMT
        Subject: C = IT, L = Roma, O = Agenzia per l'Italia Digitale, OU = Area Soluzioni per la Pubblica Amministrazione, CN = AgID CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Name Constraints:
                Permitted:
                  email:agid.gov.it
                  email:cert.informatica.aci.it
                  email:cert.interno.it
                  email:emarche.it
                  email:fastweb-pec.it
                  email:gestorepec.unina.it
                  email:kmailer.it
                  email:legalmail.it
                  email:pcert.sogei.it
                  email:pec.actalis.it
                  email:pec.ancitel.it
                  email:pec.aruba.it
                  email:pec.basilicatanet.it
                  email:pec-email.com
                  email:pec.postecert.it
                  email:pec.posteitaliane.it
                  email:pec.rupar.puglia.it
                  email:postacert.cedacri.it
                  email:postacertificata.notariato.it
                  email:postacert.it.net
                  email:postecert.it
                  email:sicurezzapostale.it
                  email:telecompost.it
                  email:trustedmail.intesa.it
                  email:twtcert.it
                  email:zucchettipec.it
                  email:cert.intesa.it
                  email:certmail.kpnqwest.it
                  DNS:agid-ca1-test.it
                  DNS:agid.gov.it
                  DNS:avanzamentodigitale.italia.it
                  DNS:cert-pa.it
                  DNS:cnipa.it
                  DNS:fascicolosanitario.gov.it
                  DNS:indicepa.it
                  DNS:indicepa.gov.it
                  DNS:pagopa.gov.it
                  DNS:postacertificata.gov.it
                  DNS:rndt.gov.it
                  DNS:spcoop.gov.it
                  DNS:spid.gov.it
                  DNS:icspc.gov.it
                  DirName:C = IT, ST = Roma, L = Roma, O = ACI Informatica S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Aruba PEC S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Agenzia per l'Italia Digitale
                  DirName:C = IT, ST = Roma, L = Roma, O = Ancitel S.p.A.
                  DirName:C = IT, ST = Parma, L = Collecchio, O = Cedacri S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Consiglio Nazionale del Notariato
                  DirName:C = IT, ST = Milano, L = Milano, O = Fastweb S.p.A.
                  DirName:C = IT, ST = Milano, L = Assago, O = ITnet S.r.l.
                  DirName:C = IT, ST = Torino, L = Torino, O = In.Te.S.A. S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = InfoCert S.p.A.
                  DirName:C = IT, ST = Bari, L = Valenzano, O = InnovaPuglia S.p.A.
                  DirName:C = IT, ST = Ancona, L = Senigallia, O = Namirial S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Poste Italiane S.p.A.
                  DirName:C = IT, ST = Potenza, L = Potenza, O = Regione Basilicata
                  DirName:C = IT, ST = Ancona, L = Ancona, O = Regione Marche
                  DirName:C = IT, ST = Firenze, L = Firenze, O = Register.it S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Sogei S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = TWT S.p.A.
                  DirName:C = IT, ST = Roma, L = Pomezia, O = Telecom Italia Trust Technologies S.r.l.
                  DirName:C = IT, ST = Napoli, L = Napoli, O = UNIVERSITA DEGLI STUDI DI NAPOLI FEDERICO II
                  DirName:C = IT, ST = Lodi, L = Lodi, O = Zucchetti S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = KPNQWEST ITALIA S.r.l.
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            Authority Information Access:
                OCSP - URI:http://ocsp07.actalis.it/VA/AUTH-ROOT
            X509v3 Subject Key Identifier:
                A5:FD:85:05:0E:C3:F1:D6:65:4A:20:6C:E2:DB:4D:60:93:2B:8A:A0
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Certificate Policies:
                Policy: 1.3.76.16.3.1
                  CPS: http://www.agid.gov.it/certificati-firma-pec
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, E-mail Protection
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 728DAF406FDA9ECD4D555DC12F27D67D6DE44524695464A120669200F20B284B
    SPKI SHA256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it","email:cert.intesa.it","email:certmail.kpnqwest.it"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### AgID CA1

- Subject: countryName=IT, localityName=Roma, organizationName=Agenzia per l'Italia Digitale, organizationalUnitName=Area Soluzioni per la Pubblica Amministrazione, commonName=AgID CA1
- Issuer: countryName=IT, localityName=Milan, organizationName=Actalis S.p.A./03358520967, commonName=Actalis Authentication Root CA
- Serial: 4981A6E353CFDAA5
- SHA-256: D070BF019CFBA46C8D3414D6FE8D7D21077F3545C2FE839E3D250F324E37C5AB
- SPKI SHA-256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
- Validity: 2017-10-12 to 2027-10-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v6.0_del_29-11-2021.pdf, https://www.agid.gov.it/sites/default/files/repository_files/icspc-sia-spki-manuale_operativo_agid_ca_v6.0_del_29-11-2021.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://ca1.agid.gov.it/CRL
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- CRL DP: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.numera.it","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5296698132058331813 (0x4981a6e353cfdaa5)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IT, L = Milan, O = Actalis S.p.A./03358520967, CN = Actalis Authentication Root CA
        Validity
            Not Before: Oct 12 13:29:53 2017 GMT
            Not After : Oct 12 13:29:53 2027 GMT
        Subject: C = IT, L = Roma, O = Agenzia per l'Italia Digitale, OU = Area Soluzioni per la Pubblica Amministrazione, CN = AgID CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.76.16.3.1
                  CPS: http://www.agid.gov.it/certificati-firma-pec
            X509v3 Subject Key Identifier:
                A5:FD:85:05:0E:C3:F1:D6:65:4A:20:6C:E2:DB:4D:60:93:2B:8A:A0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA,o%3dActalis%20S.p.A.%2f03358520967,c%3dIT?certificateRevocationList;binary
                Full Name:
                  URI:http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
            Authority Information Access:
                OCSP - URI:http://ocsp07.actalis.it/VA/AUTH-ROOT
            X509v3 Authority Key Identifier:
                52:D8:88:3A:C8:9F:78:66:ED:89:F3:7B:38:70:94:C9:02:02:36:D0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, E-mail Protection
            X509v3 Name Constraints:
                Permitted:
                  email:agid.gov.it
                  email:cert.informatica.aci.it
                  email:cert.interno.it
                  email:emarche.it
                  email:fastweb-pec.it
                  email:gestorepec.unina.it
                  email:kmailer.it
                  email:legalmail.it
                  email:pcert.sogei.it
                  email:pec.actalis.it
                  email:pec.ancitel.it
                  email:pec.aruba.it
                  email:pec.basilicatanet.it
                  email:pec-email.com
                  email:pec.numera.it
                  email:pec.postecert.it
                  email:pec.posteitaliane.it
                  email:pec.rupar.puglia.it
                  email:postacert.cedacri.it
                  email:postacertificata.notariato.it
                  email:postacert.it.net
                  email:postecert.it
                  email:sicurezzapostale.it
                  email:telecompost.it
                  email:trustedmail.intesa.it
                  email:twtcert.it
                  email:zucchettipec.it
                  DNS:agid-ca1-test.it
                  DNS:agid.gov.it
                  DNS:avanzamentodigitale.italia.it
                  DNS:cert-pa.it
                  DNS:cnipa.it
                  DNS:fascicolosanitario.gov.it
                  DNS:indicepa.gov.it
                  DNS:pagopa.gov.it
                  DNS:postacertificata.gov.it
                  DNS:rndt.gov.it
                  DNS:spcoop.gov.it
                  DNS:spid.gov.it
                  DNS:icspc.gov.it
                  DirName:C = IT, ST = Roma, L = Roma, O = ACI Informatica S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Aruba PEC S.p.A.
                  DirName:C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Agenzia per l'Italia Digitale
                  DirName:C = IT, ST = Roma, L = Roma, O = Ancitel S.p.A.
                  DirName:C = IT, ST = Parma, L = Collecchio, O = Cedacri S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Consiglio Nazionale del Notariato
                  DirName:C = IT, ST = Milano, L = Milano, O = Fastweb S.p.A.
                  DirName:C = IT, ST = Milano, L = Assago, O = ITnet S.r.l.
                  DirName:C = IT, ST = Torino, L = Torino, O = In.Te.S.A. S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = InfoCert S.p.A.
                  DirName:C = IT, ST = Bari, L = Valenzano, O = InnovaPuglia S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = KPNQwest Italia S.p.A.
                  DirName:C = IT, ST = Ancona, L = Senigallia, O = Namirial S.p.A.
                  DirName:C = IT, ST = Sassari, L = Sassari, O = Numera Sistemi e Informatica S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Poste Italiane S.p.A.
                  DirName:C = IT, ST = Potenza, L = Potenza, O = Regione Basilicata
                  DirName:C = IT, ST = Ancona, L = Ancona, O = Regione Marche
                  DirName:C = IT, ST = Firenze, L = Firenze, O = Register.it S.p.A.
                  DirName:C = IT, ST = Roma, L = Roma, O = Sogei S.p.A.
                  DirName:C = IT, ST = Milano, L = Milano, O = TWT S.p.A.
                  DirName:C = IT, ST = Roma, L = Pomezia, O = Telecom Italia Trust Technologies S.r.l.
                  DirName:C = IT, ST = Napoli, L = Napoli, O = UNIVERSITA DEGLI STUDI DI NAPOLI FEDERICO II
                  DirName:C = IT, ST = Lodi, L = Lodi, O = Zucchetti S.p.A.
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D070BF019CFBA46C8D3414D6FE8D7D21077F3545C2FE839E3D250F324E37C5AB
    SPKI SHA256: 39E3C6C6F13C9620775172694D20F81EDAD55A8613934CDAA7C3793A6D26B86B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, E-mail Protection
- Certificate Policies: 1.3.76.16.3.1
- AIA OCSP: http://ocsp07.actalis.it/VA/AUTH-ROOT
- AIA CA Issuers: -
- CRL Distribution Points: ldap://ldap07.actalis.it/cn%3dActalis%20Authentication%20Root%20CA, http://crl07.actalis.it/Repository/AUTH-ROOT/getLastCRL
- Name Constraints: {"present":true,"critical":false,"permitted":["email:agid.gov.it","email:cert.informatica.aci.it","email:cert.interno.it","email:emarche.it","email:fastweb-pec.it","email:gestorepec.unina.it","email:kmailer.it","email:legalmail.it","email:pcert.sogei.it","email:pec.actalis.it","email:pec.ancitel.it","email:pec.aruba.it","email:pec.basilicatanet.it","email:pec-email.com","email:pec.numera.it","email:pec.postecert.it","email:pec.posteitaliane.it","email:pec.rupar.puglia.it","email:postacert.cedacri.it","email:postacertificata.notariato.it","email:postacert.it.net","email:postecert.it","email:sicurezzapostale.it","email:telecompost.it","email:trustedmail.intesa.it","email:twtcert.it","email:zucchettipec.it"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
