# CA Owner Audit Dump - Amazon Trust Services

Generated: 2026-07-28T05:57:20.762000Z

## CA Owner Summary

- Name: Amazon Trust Services
- Country: United States of America
- Website: -
- Problem Reporting: https://www.amazontrust.com/repository/
- CP/CPS URLs: https://www.amazontrust.com/repository/ats-cp-cps-2.6.pdf, https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-cp-v5-15.pdf, https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-cps-v5-15.pdf, https://www.digicert.com/legal-repository/, https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ac521beb-0497-4d0e-879e-84e68c22f8f3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f460b52c-0d95-4a89-87be-c80c66658868, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2b7a4fd7-be28-4dd3-93c2-18491f1ff5b3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bae8d562-52fd-4dfe-a9fb-d661c4c2dd0d, https://bugzilla.mozilla.org/attachment.cgi?id=9569890, https://bugzilla.mozilla.org/attachment.cgi?id=9569893, https://bugzilla.mozilla.org/attachment.cgi?id=9309728, https://bugzilla.mozilla.org/attachment.cgi?id=9309729, https://bugzilla.mozilla.org/attachment.cgi?id=9309730, https://bugzilla.mozilla.org/attachment.cgi?id=9309731, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d960de8d-58e1-49cd-b021-b81d840df468, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2089114f-2403-404e-9861-bcfc60426e0f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf97e8d2-eb5b-4702-9635-a1e8fffb0903, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9260ceb-c627-473c-b934-7a2da4f8930b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b6f87753-9559-4ee9-a79a-517d669b7a9a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=69e3c555-0da9-4b06-a1c1-64756cddb5ac, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2c9785a1-7f1b-43ca-9f2b-8d0c37c841b5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=eb0921ab-b374-4b25-a6a9-6ad7f77938b1, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d2817362-d44a-4ec0-ab59-1cc231311131, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ffc2cba4-ab1a-4f7b-af96-9607dd7cae98, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7bc93007-2ea2-47a4-909f-56b015703934, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=88d88042-b82d-4307-97f3-5ee151aeadfa, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=73520ed1-f83f-48be-9cb6-2831ed6cbb30, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1391d859-d8b4-4c2d-bb91-20f22fcca71d, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2aa980c4-f5fb-4bfb-9da1-a006eaf4c611
- Root Programs: {"mozilla":"Not Yet Included","chrome":"Not Included","microsoft":"Not Included","apple":"Not Included"}

## Owner Disclosure Snapshot

- Problem reporting mechanism: https://www.amazontrust.com/repository/
- CP/CPS URLs: https://www.amazontrust.com/repository/ats-cp-cps-2.6.pdf, https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-cp-v5-15.pdf, https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-cps-v5-15.pdf, https://www.digicert.com/legal-repository/, https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ac521beb-0497-4d0e-879e-84e68c22f8f3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f460b52c-0d95-4a89-87be-c80c66658868, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2b7a4fd7-be28-4dd3-93c2-18491f1ff5b3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bae8d562-52fd-4dfe-a9fb-d661c4c2dd0d, https://bugzilla.mozilla.org/attachment.cgi?id=9569890, https://bugzilla.mozilla.org/attachment.cgi?id=9569893, https://bugzilla.mozilla.org/attachment.cgi?id=9309728, https://bugzilla.mozilla.org/attachment.cgi?id=9309729, https://bugzilla.mozilla.org/attachment.cgi?id=9309730, https://bugzilla.mozilla.org/attachment.cgi?id=9309731, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d960de8d-58e1-49cd-b021-b81d840df468, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2089114f-2403-404e-9861-bcfc60426e0f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf97e8d2-eb5b-4702-9635-a1e8fffb0903, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9260ceb-c627-473c-b934-7a2da4f8930b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b6f87753-9559-4ee9-a79a-517d669b7a9a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=69e3c555-0da9-4b06-a1c1-64756cddb5ac, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2c9785a1-7f1b-43ca-9f2b-8d0c37c841b5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=eb0921ab-b374-4b25-a6a9-6ad7f77938b1, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d2817362-d44a-4ec0-ab59-1cc231311131, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ffc2cba4-ab1a-4f7b-af96-9607dd7cae98, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7bc93007-2ea2-47a4-909f-56b015703934, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=88d88042-b82d-4307-97f3-5ee151aeadfa, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=73520ed1-f83f-48be-9cb6-2831ed6cbb30, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1391d859-d8b4-4c2d-bb91-20f22fcca71d, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2aa980c4-f5fb-4bfb-9da1-a006eaf4c611
- Repository URLs: https://www.amazontrust.com/repository/, https://www.digicert.com/legal-repository/
- Root programs: {"mozilla":"Not Yet Included","chrome":"Not Included","microsoft":"Not Included","apple":"Not Included"}
- Contact aliases: -

## Certificate Inventory

| # | Subject | CA | Lifecycle | Validity | Policies | pathLen | EKU | zlint |
|---|---|---|---|---|---|---|---|---|
| 1 | countryName=DE, organizationName=Amazon, commonName=Amazon ECDSA 256 Root EU M1 | yes | unknown | 2024-11-14 to 2042-11-14 | - | - | - | current errors: 1 |
| 2 | countryName=DE, organizationName=Amazon, commonName=Amazon ECDSA 384 Root EU M1 | yes | unknown | 2024-11-14 to 2042-11-14 | - | - | - | current errors: 1 |
| 3 | countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1 | yes | unknown | 2015-05-26 to 2038-01-17 | - | - | - | clean |
| 4 | countryName=US, organizationName=Amazon, commonName=Amazon Root CA 2 | yes | unknown | 2015-05-26 to 2040-05-26 | - | - | - | clean |
| 5 | countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3 | yes | unknown | 2015-05-26 to 2040-05-26 | - | - | - | clean |
| 6 | countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4 | yes | unknown | 2015-05-26 to 2040-05-26 | - | - | - | clean |
| 7 | countryName=DE, organizationName=Amazon, commonName=Amazon RSA 2048 Root EU M1 | yes | unknown | 2024-11-14 to 2042-11-14 | - | - | - | clean |
| 8 | countryName=US, stateOrProvinceName=Arizona, localityName=Scottsdale, organizationName=Starfield Technologies, Inc., commonName=Starfield Services Root Certificate Authority - G2 | yes | unknown | 2009-09-01 to 2037-12-31 | - | - | - | current errors: 1 |
| 9 | countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 1A, commonName=Amazon | yes | revoked | 2015-10-21 to 2040-10-21 | 2.5.29.32.0 | 0 | - | clean |
| 10 | countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 1B, commonName=Amazon | yes | revoked, expired | 2015-10-22 to 2025-10-19 | 2.23.140.1.2.1 | 0 | - | clean |
| 11 | countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 1B, commonName=Amazon | yes | revoked | 2015-10-21 to 2040-10-21 | 2.23.140.1.2.1 | 0 | - | clean |
| 12 | countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 3B, commonName=Amazon | yes | revoked | 2018-07-16 to 2028-07-16 | 2.5.29.32.0 | 0 | - | clean |
| 13 | countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 1A, commonName=Amazon | yes | revoked, expired | 2015-10-22 to 2025-10-19 | 2.5.29.32.0 | 0 | - | clean |
| 14 | countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 2A, commonName=Amazon | yes | revoked, expired | 2015-10-22 to 2025-10-19 | 2.5.29.32.0 | 0 | - | clean |
| 15 | countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 3A, commonName=Amazon | yes | revoked, expired | 2015-10-22 to 2025-10-19 | 2.5.29.32.0 | 0 | - | clean |
| 16 | countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 0A, commonName=Amazon | yes | revoked | 2015-10-21 to 2040-10-21 | 2.5.29.32.0 | 0 | - | clean |
| 17 | countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 4A, commonName=Amazon | yes | revoked, expired | 2015-10-22 to 2025-10-19 | 2.5.29.32.0 | 0 | - | clean |
| 18 | countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 0A, commonName=Amazon | yes | revoked, expired | 2015-10-22 to 2025-10-19 | 2.5.29.32.0 | 0 | - | clean |
| 19 | countryName=DE, organizationName=Amazon, commonName=Amazon ECDSA 256 EU M01 | yes | current | 2024-11-14 to 2032-11-14 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 20 | Amazon ECDSA 256 EU S00 | yes | current | 2025-10-01 to 2033-09-29 | - | - | - | current errors: 1 |
| 21 | Amazon ECDSA 256 EU S01 | yes | current | 2025-10-01 to 2033-09-29 | - | - | - | current errors: 1 |
| 22 | Amazon ECDSA 256 EU S02 | yes | current | 2025-10-01 to 2033-09-29 | - | - | - | current errors: 1 |
| 23 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 M01 | yes | current | 2022-08-23 to 2030-08-23 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 24 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 M02 | yes | current | 2022-08-23 to 2030-08-23 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 25 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 M03 | yes | current | 2022-08-23 to 2030-08-23 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 26 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 M04 | yes | current | 2022-08-23 to 2030-08-23 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 27 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 M05 | yes | current | 2025-01-13 to 2033-01-13 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 28 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 M06 | yes | current | 2025-01-13 to 2033-01-13 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 29 | countryName=DE, organizationName=Amazon, commonName=Amazon ECDSA 256 Root EU M1 | yes | current | 2025-09-17 to 2033-09-15 | 2.23.140.1.2.1 | - | TLS Web Server Authentication | current errors: 1 |
| 30 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S00 | yes | revoked | 2025-05-28 to 2033-05-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 31 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S01 | yes | revoked | 2025-05-28 to 2033-05-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 32 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S02 | yes | revoked | 2025-05-28 to 2033-05-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 33 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S03 | yes | revoked | 2025-05-28 to 2033-05-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 34 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S04 | yes | revoked | 2025-05-28 to 2033-05-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 35 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S05 | yes | revoked | 2025-05-28 to 2033-05-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 36 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S06 | yes | current | 2026-04-22 to 2029-04-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 37 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S07 | yes | current | 2026-04-22 to 2029-04-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 38 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S08 | yes | current | 2026-04-22 to 2029-04-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 39 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S09 | yes | current | 2026-04-22 to 2029-04-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 40 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S10 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 41 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S11 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 42 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S12 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 43 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S13 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 44 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S14 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 45 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S15 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 46 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S16 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 47 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S17 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 48 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S18 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 49 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S19 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 50 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S20 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 51 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S21 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 52 | countryName=DE, organizationName=Amazon, commonName=Amazon ECDSA 384 EU M01 | yes | current | 2024-11-14 to 2032-11-14 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 53 | Amazon ECDSA 384 EU S00 | yes | current | 2025-10-01 to 2033-09-29 | - | - | - | current errors: 1 |
| 54 | Amazon ECDSA 384 EU S01 | yes | current | 2025-10-01 to 2033-09-29 | - | - | - | current errors: 1 |
| 55 | Amazon ECDSA 384 EU S02 | yes | current | 2025-10-01 to 2033-09-29 | - | - | - | current errors: 1 |
| 56 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 M01 | yes | current | 2022-08-23 to 2030-08-23 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 57 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 M02 | yes | current | 2022-08-23 to 2030-08-23 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 58 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 M03 | yes | current | 2022-08-23 to 2030-08-23 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 59 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 M04 | yes | current | 2022-08-23 to 2030-08-23 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 60 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 M05 | yes | current | 2025-01-13 to 2033-01-13 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 61 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 M06 | yes | current | 2025-01-13 to 2033-01-13 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 62 | countryName=DE, organizationName=Amazon, commonName=Amazon ECDSA 384 Root EU M1 | yes | current | 2025-09-17 to 2033-09-15 | 2.23.140.1.2.1 | - | TLS Web Server Authentication | current errors: 1 |
| 63 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S00 | yes | revoked | 2025-05-28 to 2033-05-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 64 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S01 | yes | revoked | 2025-05-28 to 2033-05-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 65 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S02 | yes | revoked | 2025-05-28 to 2033-05-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 66 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S03 | yes | revoked | 2025-05-28 to 2033-05-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 67 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S04 | yes | revoked | 2025-05-28 to 2033-05-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 68 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S05 | yes | revoked | 2025-05-28 to 2033-05-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 69 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S06 | yes | current | 2026-04-22 to 2029-04-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 70 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S07 | yes | current | 2026-04-22 to 2029-04-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 71 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S08 | yes | current | 2026-04-22 to 2029-04-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 72 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S09 | yes | current | 2026-04-22 to 2029-04-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 73 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S10 | yes | current | 2026-04-22 to 2029-04-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 74 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S11 | yes | current | 2026-04-22 to 2029-04-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 75 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S12 | yes | current | 2026-04-22 to 2029-04-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 76 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S13 | yes | current | 2026-04-22 to 2029-04-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 77 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S14 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 78 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S15 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 79 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S16 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 80 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S17 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 81 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S18 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 82 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S19 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 83 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S20 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 84 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S21 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 85 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S22 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 86 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S23 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 87 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S24 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 88 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S25 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 89 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S26 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 90 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S27 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 91 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S28 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 92 | countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S29 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 93 | countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1 | yes | current | 2015-10-21 to 2037-12-31 | 2.5.29.32.0 | - | - | clean |
| 94 | countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1 | yes | current | 2015-05-25 to 2037-12-31 | 2.5.29.32.0 | - | - | clean |
| 95 | countryName=US, organizationName=Amazon, commonName=Amazon Root CA 2 | yes | current | 2015-05-25 to 2037-12-31 | 2.5.29.32.0 | - | - | clean |
| 96 | countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3 | yes | current | 2015-05-25 to 2037-12-31 | 2.5.29.32.0 | - | - | clean |
| 97 | countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4 | yes | current | 2015-05-25 to 2037-12-31 | 2.5.29.32.0 | - | - | clean |
| 98 | countryName=DE, organizationName=Amazon, commonName=Amazon RSA 2048 EU M01 | yes | current | 2024-11-14 to 2032-11-14 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 99 | Amazon RSA 2048 EU S00 | yes | current | 2025-10-01 to 2033-09-29 | - | - | - | clean |
| 100 | Amazon RSA 2048 EU S01 | yes | current | 2025-10-01 to 2033-09-29 | - | - | - | clean |
| 101 | Amazon RSA 2048 EU S02 | yes | current | 2025-10-01 to 2033-09-29 | - | - | - | clean |
| 102 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 M01 | yes | current | 2022-08-23 to 2030-08-23 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 103 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 M02 | yes | current | 2022-08-23 to 2030-08-23 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 104 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 M03 | yes | current | 2022-08-23 to 2030-08-23 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 105 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 M04 | yes | current | 2022-08-23 to 2030-08-23 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 106 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 M05 | yes | current | 2025-01-13 to 2033-01-13 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 107 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 M06 | yes | current | 2025-01-13 to 2033-01-13 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 108 | countryName=DE, organizationName=Amazon, commonName=Amazon RSA 2048 Root EU M1 | yes | current | 2025-09-17 to 2033-09-15 | 2.23.140.1.2.1 | - | TLS Web Server Authentication | clean |
| 109 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S00 | yes | revoked | 2025-05-28 to 2033-05-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 110 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S01 | yes | revoked | 2025-05-28 to 2033-05-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 111 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S02 | yes | revoked | 2025-05-28 to 2033-05-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 112 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S03 | yes | revoked | 2025-05-28 to 2033-05-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 113 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S04 | yes | revoked | 2025-05-28 to 2033-05-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 114 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S05 | yes | revoked | 2025-05-28 to 2033-05-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 115 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S06 | yes | current | 2026-04-22 to 2029-04-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 116 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S07 | yes | current | 2026-04-22 to 2029-04-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 117 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S08 | yes | current | 2026-04-22 to 2029-04-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 118 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S09 | yes | current | 2026-04-22 to 2029-04-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 119 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S10 | yes | current | 2026-04-22 to 2029-04-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 120 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S11 | yes | current | 2026-04-22 to 2029-04-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 121 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S12 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 122 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S13 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 123 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S14 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 124 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S15 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 125 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S16 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 126 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S17 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 127 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S18 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 128 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S19 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 129 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S20 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 130 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S21 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 131 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S22 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 132 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S23 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 133 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S24 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 134 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S25 | yes | current | 2026-07-08 to 2029-07-07 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | not_available |
| 135 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 4096 M01 | yes | current | 2022-08-23 to 2030-08-23 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 136 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 4096 M02 | yes | current | 2022-08-23 to 2030-08-23 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 137 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 4096 M03 | yes | current | 2022-08-23 to 2030-08-23 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 138 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 4096 M04 | yes | current | 2022-08-23 to 2030-08-23 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 139 | countryName=US, organizationName=Amazon, commonName=Amazon RSA 4096 M05 | yes | current | 2025-01-13 to 2033-01-13 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |

## Certificate Details

### Amazon ECDSA 256 Root EU M1

- Subject: countryName=DE, organizationName=Amazon, commonName=Amazon ECDSA 256 Root EU M1
- Issuer: countryName=DE, organizationName=Amazon, commonName=Amazon ECDSA 256 Root EU M1
- Serial: 07C0CD896CCB9C16046C1821A64C6C7B29DD3F
- SHA-256: 9EAD32C9285FE68BA2C5B0FE427D149B103FDFA1D0958D77C3DA0FF246E853D3
- SPKI SHA-256: 9565907725464BE0BFF44B1232F85EE862A9A0D99DB971BA20344AAF41431D58
- Validity: 2024-11-14 to 2042-11-14
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.amazontrust.com/repository/ats-cp-cps-2.6.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ac521beb-0497-4d0e-879e-84e68c22f8f3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f460b52c-0d95-4a89-87be-c80c66658868, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2b7a4fd7-be28-4dd3-93c2-18491f1ff5b3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bae8d562-52fd-4dfe-a9fb-d661c4c2dd0d, https://bugzilla.mozilla.org/attachment.cgi?id=9569890, https://bugzilla.mozilla.org/attachment.cgi?id=9569893
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://eue2m1.crl.root.amznts.eu/eue2m1.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:c0:cd:89:6c:cb:9c:16:04:6c:18:21:a6:4c:6c:7b:29:dd:3f
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = DE, O = Amazon, CN = Amazon ECDSA 256 Root EU M1
        Validity
            Not Before: Nov 14 12:45:51 2024 GMT
            Not After : Nov 14 12:45:51 2042 GMT
        Subject: C = DE, O = Amazon, CN = Amazon ECDSA 256 Root EU M1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                71:D1:7F:72:D9:B8:19:2D:F0:11:A5:CD:B5:86:4F:6E:1F:DD:E5:A2
            X509v3 Authority Key Identifier:
                71:D1:7F:72:D9:B8:19:2D:F0:11:A5:CD:B5:86:4F:6E:1F:DD:E5:A2
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 9EAD32C9285FE68BA2C5B0FE427D149B103FDFA1D0958D77C3DA0FF246E853D3
    SPKI SHA256: 9565907725464BE0BFF44B1232F85EE862A9A0D99DB971BA20344AAF41431D58
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Amazon ECDSA 384 Root EU M1

- Subject: countryName=DE, organizationName=Amazon, commonName=Amazon ECDSA 384 Root EU M1
- Issuer: countryName=DE, organizationName=Amazon, commonName=Amazon ECDSA 384 Root EU M1
- Serial: 07C0CD896CCE23ECD573BD64989662AB25DFE9
- SHA-256: 8E136CE0E77C848F2D2910ABD4E3A764358BB1B7A4932202BC9B915732462D85
- SPKI SHA-256: 798FE10957E8C5A0874201CAF09D5EF4B2E2412C47BF991949566CB542D3AF3F
- Validity: 2024-11-14 to 2042-11-14
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.amazontrust.com/repository/ats-cp-cps-2.6.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ac521beb-0497-4d0e-879e-84e68c22f8f3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f460b52c-0d95-4a89-87be-c80c66658868, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2b7a4fd7-be28-4dd3-93c2-18491f1ff5b3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bae8d562-52fd-4dfe-a9fb-d661c4c2dd0d, https://bugzilla.mozilla.org/attachment.cgi?id=9569890, https://bugzilla.mozilla.org/attachment.cgi?id=9569893
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://eue3m1.crl.root.amznts.eu/eue3m1.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:c0:cd:89:6c:ce:23:ec:d5:73:bd:64:98:96:62:ab:25:df:e9
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = Amazon, CN = Amazon ECDSA 384 Root EU M1
        Validity
            Not Before: Nov 14 12:46:12 2024 GMT
            Not After : Nov 14 12:46:12 2042 GMT
        Subject: C = DE, O = Amazon, CN = Amazon ECDSA 384 Root EU M1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B1:BB:47:20:39:9A:7D:80:17:1D:A6:05:5C:18:67:0C:1B:54:A2:A8
            X509v3 Authority Key Identifier:
                B1:BB:47:20:39:9A:7D:80:17:1D:A6:05:5C:18:67:0C:1B:54:A2:A8
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 8E136CE0E77C848F2D2910ABD4E3A764358BB1B7A4932202BC9B915732462D85
    SPKI SHA256: 798FE10957E8C5A0874201CAF09D5EF4B2E2412C47BF991949566CB542D3AF3F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Amazon Root CA 1

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 066C9FCF99BF8C0A39E2F0788A43E696365BCA
- SHA-256: 8ECDE6884F3D87B1125BA31AC3FCB13D7016DE7F57CC904FE1CB97C6AE98196E
- SPKI SHA-256: FBE3018031F9586BCBF41727E417B7D1C45C2F47F93BE372A17B96B50757D5A2
- Validity: 2015-05-26 to 2038-01-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.amazontrust.com/repository/ats-cp-cps-2.6.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ac521beb-0497-4d0e-879e-84e68c22f8f3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f460b52c-0d95-4a89-87be-c80c66658868, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2b7a4fd7-be28-4dd3-93c2-18491f1ff5b3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bae8d562-52fd-4dfe-a9fb-d661c4c2dd0d, https://bugzilla.mozilla.org/attachment.cgi?id=9569890, https://bugzilla.mozilla.org/attachment.cgi?id=9569893
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.rootca1.amazontrust.com/rootca1.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:6c:9f:cf:99:bf:8c:0a:39:e2:f0:78:8a:43:e6:96:36:5b:ca
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: May 26 00:00:00 2015 GMT
            Not After : Jan 17 00:00:00 2038 GMT
        Subject: C = US, O = Amazon, CN = Amazon Root CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8ECDE6884F3D87B1125BA31AC3FCB13D7016DE7F57CC904FE1CB97C6AE98196E
    SPKI SHA256: FBE3018031F9586BCBF41727E417B7D1C45C2F47F93BE372A17B96B50757D5A2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Amazon Root CA 2

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 2
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 2
- Serial: 066C9FD29635869F0A0FE58678F85B26BB8A37
- SHA-256: 1BA5B2AA8C65401A82960118F80BEC4F62304D83CEC4713A19C39C011EA46DB4
- SPKI SHA-256: 7F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461
- Validity: 2015-05-26 to 2040-05-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.amazontrust.com/repository/ats-cp-cps-2.6.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ac521beb-0497-4d0e-879e-84e68c22f8f3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f460b52c-0d95-4a89-87be-c80c66658868, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2b7a4fd7-be28-4dd3-93c2-18491f1ff5b3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bae8d562-52fd-4dfe-a9fb-d661c4c2dd0d, https://bugzilla.mozilla.org/attachment.cgi?id=9569890, https://bugzilla.mozilla.org/attachment.cgi?id=9569893
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.rootca2.amazontrust.com/rootca2.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:6c:9f:d2:96:35:86:9f:0a:0f:e5:86:78:f8:5b:26:bb:8a:37
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 2
        Validity
            Not Before: May 26 00:00:00 2015 GMT
            Not After : May 26 00:00:00 2040 GMT
        Subject: C = US, O = Amazon, CN = Amazon Root CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B0:0C:F0:4C:30:F4:05:58:02:48:FD:33:E5:52:AF:4B:84:E3:66:52
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 1BA5B2AA8C65401A82960118F80BEC4F62304D83CEC4713A19C39C011EA46DB4
    SPKI SHA256: 7F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Amazon Root CA 3

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 066C9FD5749736663F3B0B9AD9E89E7603F24A
- SHA-256: 18CE6CFE7BF14E60B2E347B8DFE868CB31D02EBB3ADA271569F50343B46DB3A4
- SPKI SHA-256: 36ABC32656ACFC645C61B71613C4BF21C787F5CABBEE48348D58597803D7ABC9
- Validity: 2015-05-26 to 2040-05-26
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.amazontrust.com/repository/ats-cp-cps-2.6.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ac521beb-0497-4d0e-879e-84e68c22f8f3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f460b52c-0d95-4a89-87be-c80c66658868, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2b7a4fd7-be28-4dd3-93c2-18491f1ff5b3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bae8d562-52fd-4dfe-a9fb-d661c4c2dd0d, https://bugzilla.mozilla.org/attachment.cgi?id=9569890, https://bugzilla.mozilla.org/attachment.cgi?id=9569893
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.rootca3.amazontrust.com/rootca3.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:6c:9f:d5:74:97:36:66:3f:3b:0b:9a:d9:e8:9e:76:03:f2:4a
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: May 26 00:00:00 2015 GMT
            Not After : May 26 00:00:00 2040 GMT
        Subject: C = US, O = Amazon, CN = Amazon Root CA 3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 18CE6CFE7BF14E60B2E347B8DFE868CB31D02EBB3ADA271569F50343B46DB3A4
    SPKI SHA256: 36ABC32656ACFC645C61B71613C4BF21C787F5CABBEE48348D58597803D7ABC9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Amazon Root CA 4

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 066C9FD7C1BB104C2943E5717B7B2CC81AC10E
- SHA-256: E35D28419ED02025CFA69038CD623962458DA5C695FBDEA3C22B0BFB25897092
- SPKI SHA-256: F7ECDED5C66047D28ED6466B543C40E0743ABE81D109254DCF845D4C2C7853C5
- Validity: 2015-05-26 to 2040-05-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.amazontrust.com/repository/ats-cp-cps-2.6.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ac521beb-0497-4d0e-879e-84e68c22f8f3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f460b52c-0d95-4a89-87be-c80c66658868, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2b7a4fd7-be28-4dd3-93c2-18491f1ff5b3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bae8d562-52fd-4dfe-a9fb-d661c4c2dd0d, https://bugzilla.mozilla.org/attachment.cgi?id=9569890, https://bugzilla.mozilla.org/attachment.cgi?id=9569893
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.rootca4.amazontrust.com/rootca4.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:6c:9f:d7:c1:bb:10:4c:29:43:e5:71:7b:7b:2c:c8:1a:c1:0e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: May 26 00:00:00 2015 GMT
            Not After : May 26 00:00:00 2040 GMT
        Subject: C = US, O = Amazon, CN = Amazon Root CA 4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E35D28419ED02025CFA69038CD623962458DA5C695FBDEA3C22B0BFB25897092
    SPKI SHA256: F7ECDED5C66047D28ED6466B543C40E0743ABE81D109254DCF845D4C2C7853C5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Amazon RSA 2048 Root EU M1

- Subject: countryName=DE, organizationName=Amazon, commonName=Amazon RSA 2048 Root EU M1
- Issuer: countryName=DE, organizationName=Amazon, commonName=Amazon RSA 2048 Root EU M1
- Serial: 07C0CD896CC3E9D4D2A560CC070B7DBD2CF721
- SHA-256: EAFFAC50C7E3E15A68F779A5E70EC2F5E9FC4A03FF69AB337B4D6C4510432395
- SPKI SHA-256: 8D935558E6A3C896330148FFDF6A1AC0A5BFBA1AB44545135A3B376C9A1A308D
- Validity: 2024-11-14 to 2042-11-14
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.amazontrust.com/repository/ats-cp-cps-2.6.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ac521beb-0497-4d0e-879e-84e68c22f8f3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f460b52c-0d95-4a89-87be-c80c66658868, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2b7a4fd7-be28-4dd3-93c2-18491f1ff5b3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bae8d562-52fd-4dfe-a9fb-d661c4c2dd0d, https://bugzilla.mozilla.org/attachment.cgi?id=9569890, https://bugzilla.mozilla.org/attachment.cgi?id=9569893
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://eur2m1.crl.root.amznts.eu/eur2m1.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:c0:cd:89:6c:c3:e9:d4:d2:a5:60:cc:07:0b:7d:bd:2c:f7:21
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = Amazon, CN = Amazon RSA 2048 Root EU M1
        Validity
            Not Before: Nov 14 12:45:15 2024 GMT
            Not After : Nov 14 12:45:15 2042 GMT
        Subject: C = DE, O = Amazon, CN = Amazon RSA 2048 Root EU M1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                28:31:04:AC:48:7C:49:E8:50:23:44:3D:7F:CC:D5:35:02:73:0A:89
            X509v3 Authority Key Identifier:
                28:31:04:AC:48:7C:49:E8:50:23:44:3D:7F:CC:D5:35:02:73:0A:89
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EAFFAC50C7E3E15A68F779A5E70EC2F5E9FC4A03FF69AB337B4D6C4510432395
    SPKI SHA256: 8D935558E6A3C896330148FFDF6A1AC0A5BFBA1AB44545135A3B376C9A1A308D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Starfield Services Root Certificate Authority - G2

- Subject: countryName=US, stateOrProvinceName=Arizona, localityName=Scottsdale, organizationName=Starfield Technologies, Inc., commonName=Starfield Services Root Certificate Authority - G2
- Issuer: countryName=US, stateOrProvinceName=Arizona, localityName=Scottsdale, organizationName=Starfield Technologies, Inc., commonName=Starfield Services Root Certificate Authority - G2
- Serial: 0
- SHA-256: 568D6905A2C88708A4B3025190EDCFEDB1974A606A13C6E5290FCB2AE63EDAB5
- SPKI SHA-256: 2B071C59A0A0AE76B0EADB2BAD23BAD4580B69C3601B630C2EAF0613AFA83F92
- Validity: 2009-09-01 to 2037-12-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.amazontrust.com/repository/ats-cp-cps-2.6.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ac521beb-0497-4d0e-879e-84e68c22f8f3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f460b52c-0d95-4a89-87be-c80c66658868, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2b7a4fd7-be28-4dd3-93c2-18491f1ff5b3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bae8d562-52fd-4dfe-a9fb-d661c4c2dd0d, https://bugzilla.mozilla.org/attachment.cgi?id=9569890, https://bugzilla.mozilla.org/attachment.cgi?id=9569893
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.rootg2.amazontrust.com/rootg2.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Removed","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 0 (0x0)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2
        Validity
            Not Before: Sep  1 00:00:00 2009 GMT
            Not After : Dec 31 23:59:59 2037 GMT
        Subject: C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                9C:5F:00:DF:AA:01:D7:30:2B:38:88:A2:B8:6D:4A:9C:F2:11:91:83
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 568D6905A2C88708A4B3025190EDCFEDB1974A606A13C6E5290FCB2AE63EDAB5
    SPKI SHA256: 2B071C59A0A0AE76B0EADB2BAD23BAD4580B69C3601B630C2EAF0613AFA83F92
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_serial_number_not_positive: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Amazon

- Subject: countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 1A, commonName=Amazon
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 067B50581E5545823C0BA62F6309DE5FCA494C
- SHA-256: 80DD9E3497F354E30B8ACF39D046DD4F5A618F7889236EB34F78D54D15CD6A50
- SPKI SHA-256: 64BB5BD80311FA3F53BD99404CAB8762AD6E048447D0A97F219FCECA1661F37C
- Validity: 2015-10-21 to 2040-10-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:7b:50:58:1e:55:45:82:3c:0b:a6:2f:63:09:de:5f:ca:49:4c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Oct 21 22:23:40 2015 GMT
            Not After : Oct 21 22:23:40 2040 GMT
        Subject: C = US, O = Amazon, OU = Server CA 1A, CN = Amazon
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                62:D4:42:5E:86:70:75:6A:90:BC:C6:B8:D2:4D:60:C2:34:BA:51:3A
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crl.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 80DD9E3497F354E30B8ACF39D046DD4F5A618F7889236EB34F78D54D15CD6A50
    SPKI SHA256: 64BB5BD80311FA3F53BD99404CAB8762AD6E048447D0A97F219FCECA1661F37C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crl.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon

- Subject: countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 1B, commonName=Amazon
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 067F94578587E8AC77DEB253325BBC998B560D
- SHA-256: F55F9FFCB83C73453261601C7E044DB15A0F034B93C05830F28635EF889CF670
- SPKI SHA-256: 252333A8E3ABB72393D6499ABBACCA8604FAEFA84681CCC3E5531D44CC896450
- Validity: 2015-10-22 to 2025-10-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-cp-v5-15.pdf, https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-cps-v5-15.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=9309728, https://bugzilla.mozilla.org/attachment.cgi?id=9309729, https://bugzilla.mozilla.org/attachment.cgi?id=9309730, https://bugzilla.mozilla.org/attachment.cgi?id=9309731
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.sca1b.amazontrust.com/sca1b-1.crl, http://crl.sca1b.amazontrust.com/sca1b.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:7f:94:57:85:87:e8:ac:77:de:b2:53:32:5b:bc:99:8b:56:0d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Oct 22 00:00:00 2015 GMT
            Not After : Oct 19 00:00:00 2025 GMT
        Subject: C = US, O = Amazon, OU = Server CA 1B, CN = Amazon
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                59:A4:66:06:52:A0:7B:95:92:3C:A3:94:07:27:96:74:5B:F9:3D:D0
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F55F9FFCB83C73453261601C7E044DB15A0F034B93C05830F28635EF889CF670
    SPKI SHA256: 252333A8E3ABB72393D6499ABBACCA8604FAEFA84681CCC3E5531D44CC896450
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Amazon

- Subject: countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 1B, commonName=Amazon
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 067B505C2A6527BC1EBE2DA2D19998EDB89B2C
- SHA-256: 4A1FF6BBF481170D3B773CEC1F3A84DE3B5096575CDBF8B08432209318CA0FBD
- SPKI SHA-256: 252333A8E3ABB72393D6499ABBACCA8604FAEFA84681CCC3E5531D44CC896450
- Validity: 2015-10-21 to 2040-10-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-cp-v5-15.pdf, https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-cps-v5-15.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=9309728, https://bugzilla.mozilla.org/attachment.cgi?id=9309729, https://bugzilla.mozilla.org/attachment.cgi?id=9309730, https://bugzilla.mozilla.org/attachment.cgi?id=9309731
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.sca1b.amazontrust.com/sca1b-1.crl, http://crl.sca1b.amazontrust.com/sca1b.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:7b:50:5c:2a:65:27:bc:1e:be:2d:a2:d1:99:98:ed:b8:9b:2c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Oct 21 22:24:34 2015 GMT
            Not After : Oct 21 22:24:34 2040 GMT
        Subject: C = US, O = Amazon, OU = Server CA 1B, CN = Amazon
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                59:A4:66:06:52:A0:7B:95:92:3C:A3:94:07:27:96:74:5B:F9:3D:D0
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crl.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4A1FF6BBF481170D3B773CEC1F3A84DE3B5096575CDBF8B08432209318CA0FBD
    SPKI SHA256: 252333A8E3ABB72393D6499ABBACCA8604FAEFA84681CCC3E5531D44CC896450
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crl.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon

- Subject: countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 3B, commonName=Amazon
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 06DE6553F4712A18312DFDA2B4846D1B36F76E
- SHA-256: ECC295B6DDCD084BA7179FB53BDD1D422CB6C0A8D94F154D4A5B17780B7279ED
- SPKI SHA-256: B394913E6850FFD338A414C91496CD7DFE437BA2AE66966BEABD7F6648146DB1
- Validity: 2018-07-16 to 2028-07-16
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d960de8d-58e1-49cd-b021-b81d840df468, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2089114f-2403-404e-9861-bcfc60426e0f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf97e8d2-eb5b-4702-9635-a1e8fffb0903, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9260ceb-c627-473c-b934-7a2da4f8930b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b6f87753-9559-4ee9-a79a-517d669b7a9a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=69e3c555-0da9-4b06-a1c1-64756cddb5ac
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.sca3b.amazontrust.com/sca3b.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:de:65:53:f4:71:2a:18:31:2d:fd:a2:b4:84:6d:1b:36:f7:6e
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: Jul 16 22:06:27 2018 GMT
            Not After : Jul 16 22:06:27 2028 GMT
        Subject: C = US, O = Amazon, OU = Server CA 3B, CN = Amazon
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                AE:5C:80:FF:42:97:C9:C3:A0:9B:65:0B:04:CE:9E:71:7F:3E:CE:5A
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: ECC295B6DDCD084BA7179FB53BDD1D422CB6C0A8D94F154D4A5B17780B7279ED
    SPKI SHA256: B394913E6850FFD338A414C91496CD7DFE437BA2AE66966BEABD7F6648146DB1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon

- Subject: countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 1A, commonName=Amazon
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 067F9457508C648C09CA652E71791830E72592
- SHA-256: 39C763A9CF19D923F977D23626AB890449A444AB8B795C815EF1EF81FEBC1E38
- SPKI SHA-256: 64BB5BD80311FA3F53BD99404CAB8762AD6E048447D0A97F219FCECA1661F37C
- Validity: 2015-10-22 to 2025-10-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Amazon
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2c9785a1-7f1b-43ca-9f2b-8d0c37c841b5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=eb0921ab-b374-4b25-a6a9-6ad7f77938b1, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d2817362-d44a-4ec0-ab59-1cc231311131
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:7f:94:57:50:8c:64:8c:09:ca:65:2e:71:79:18:30:e7:25:92
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Oct 22 00:00:00 2015 GMT
            Not After : Oct 19 00:00:00 2025 GMT
        Subject: C = US, O = Amazon, OU = Server CA 1A, CN = Amazon
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                62:D4:42:5E:86:70:75:6A:90:BC:C6:B8:D2:4D:60:C2:34:BA:51:3A
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 39C763A9CF19D923F977D23626AB890449A444AB8B795C815EF1EF81FEBC1E38
    SPKI SHA256: 64BB5BD80311FA3F53BD99404CAB8762AD6E048447D0A97F219FCECA1661F37C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Amazon

- Subject: countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 2A, commonName=Amazon
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 2
- Serial: 067F945755F187A91F8163F3E624620177FF38
- SHA-256: 72130E3B28900349214617F4D6F3FB85D08475EE78BF095C59458A14D1828866
- SPKI SHA-256: 1BDA5AFFF83781380BF708198F9F7D2DB1E067F14BB9EA7BAE70AAC0B0305E7B
- Validity: 2015-10-22 to 2025-10-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Amazon
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2c9785a1-7f1b-43ca-9f2b-8d0c37c841b5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=eb0921ab-b374-4b25-a6a9-6ad7f77938b1, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d2817362-d44a-4ec0-ab59-1cc231311131
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca2.amazontrust.com
- CRL DP: http://crl.rootca2.amazontrust.com/rootca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:7f:94:57:55:f1:87:a9:1f:81:63:f3:e6:24:62:01:77:ff:38
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 2
        Validity
            Not Before: Oct 22 00:00:00 2015 GMT
            Not After : Oct 19 00:00:00 2025 GMT
        Subject: C = US, O = Amazon, OU = Server CA 2A, CN = Amazon
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                DA:43:4A:D0:FC:01:C0:4B:BF:58:27:8C:76:CD:0A:81:F3:94:2E:F4
            X509v3 Authority Key Identifier:
                B0:0C:F0:4C:30:F4:05:58:02:48:FD:33:E5:52:AF:4B:84:E3:66:52
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca2.amazontrust.com
                CA Issuers - URI:http://crt.rootca2.amazontrust.com/rootca2.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca2.amazontrust.com/rootca2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 72130E3B28900349214617F4D6F3FB85D08475EE78BF095C59458A14D1828866
    SPKI SHA256: 1BDA5AFFF83781380BF708198F9F7D2DB1E067F14BB9EA7BAE70AAC0B0305E7B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.rootca2.amazontrust.com
- AIA CA Issuers: http://crt.rootca2.amazontrust.com/rootca2.cer
- CRL Distribution Points: http://crl.rootca2.amazontrust.com/rootca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Amazon

- Subject: countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 3A, commonName=Amazon
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 067F945758FE55B9EE3F75831D47F07D226C8A
- SHA-256: 205154B777EDC55A5146585A5E54E054A70BE4AAD3B85D02318DA27BF807ADF1
- SPKI SHA-256: 7C53B5DF79135D9AF6195EF6BB73AB98C2C89950B892B192DFFD784DB925A41C
- Validity: 2015-10-22 to 2025-10-19
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Amazon
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2c9785a1-7f1b-43ca-9f2b-8d0c37c841b5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=eb0921ab-b374-4b25-a6a9-6ad7f77938b1, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d2817362-d44a-4ec0-ab59-1cc231311131
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:7f:94:57:58:fe:55:b9:ee:3f:75:83:1d:47:f0:7d:22:6c:8a
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: Oct 22 00:00:00 2015 GMT
            Not After : Oct 19 00:00:00 2025 GMT
        Subject: C = US, O = Amazon, OU = Server CA 3A, CN = Amazon
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                04:DC:E0:95:E5:E8:B9:6B:94:A1:EF:8C:5B:31:1E:13:7E:55:97:DA
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 205154B777EDC55A5146585A5E54E054A70BE4AAD3B85D02318DA27BF807ADF1
    SPKI SHA256: 7C53B5DF79135D9AF6195EF6BB73AB98C2C89950B892B192DFFD784DB925A41C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Amazon

- Subject: countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 0A, commonName=Amazon
- Issuer: countryName=US, stateOrProvinceName=Arizona, localityName=Scottsdale, organizationName=Starfield Technologies, Inc., commonName=Starfield Services Root Certificate Authority - G2
- Serial: 067B50529DD65F581AD5F5C55A5A7918A16F93
- SHA-256: E39D3ED886E5A3AF26B9D6AB608028BC6FBC52E599CB323DA7E9E775B530337C
- SPKI SHA-256: B58539ECAA13921CCDB80D38D34875FDE6471C5A159D9BEEF2FA6F99983BD611
- Validity: 2015-10-21 to 2040-10-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootg2.amazontrust.com
- CRL DP: http://crl.rootg2.amazontrust.com/rootg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:7b:50:52:9d:d6:5f:58:1a:d5:f5:c5:5a:5a:79:18:a1:6f:93
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2
        Validity
            Not Before: Oct 21 22:22:27 2015 GMT
            Not After : Oct 21 22:22:27 2040 GMT
        Subject: C = US, O = Amazon, OU = Server CA 0A, CN = Amazon
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                97:EA:C4:22:D2:06:18:ED:85:04:FF:DC:52:C2:6E:DB:0E:06:E1:3F
            X509v3 Authority Key Identifier:
                9C:5F:00:DF:AA:01:D7:30:2B:38:88:A2:B8:6D:4A:9C:F2:11:91:83
            Authority Information Access:
                OCSP - URI:http://ocsp.rootg2.amazontrust.com
                CA Issuers - URI:http://crl.rootg2.amazontrust.com/rootg2.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootg2.amazontrust.com/rootg2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E39D3ED886E5A3AF26B9D6AB608028BC6FBC52E599CB323DA7E9E775B530337C
    SPKI SHA256: B58539ECAA13921CCDB80D38D34875FDE6471C5A159D9BEEF2FA6F99983BD611
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.rootg2.amazontrust.com
- AIA CA Issuers: http://crl.rootg2.amazontrust.com/rootg2.cer
- CRL Distribution Points: http://crl.rootg2.amazontrust.com/rootg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon

- Subject: countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 4A, commonName=Amazon
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 067F94575A8862A9072E3239C37CEBA1274E18
- SHA-256: 7BED29276ACBED9F176F38BBA3A67CE5815B5CBF1522C7BB59ECD86B09E16ED2
- SPKI SHA-256: 17708DFF2B7FAEC9CB1B5215EBB2421D97B0543C936FAC9D6E02B92F20E5C707
- Validity: 2015-10-22 to 2025-10-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Amazon
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2c9785a1-7f1b-43ca-9f2b-8d0c37c841b5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=eb0921ab-b374-4b25-a6a9-6ad7f77938b1, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d2817362-d44a-4ec0-ab59-1cc231311131
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:7f:94:57:5a:88:62:a9:07:2e:32:39:c3:7c:eb:a1:27:4e:18
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Oct 22 00:00:00 2015 GMT
            Not After : Oct 19 00:00:00 2025 GMT
        Subject: C = US, O = Amazon, OU = Server CA 4A, CN = Amazon
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                A5:21:CD:DB:EB:53:21:99:AA:CA:D9:67:42:94:25:B2:7B:F4:C2:E3
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 7BED29276ACBED9F176F38BBA3A67CE5815B5CBF1522C7BB59ECD86B09E16ED2
    SPKI SHA256: 17708DFF2B7FAEC9CB1B5215EBB2421D97B0543C936FAC9D6E02B92F20E5C707
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Amazon

- Subject: countryName=US, organizationName=Amazon, organizationalUnitName=Server CA 0A, commonName=Amazon
- Issuer: countryName=US, stateOrProvinceName=Arizona, localityName=Scottsdale, organizationName=Starfield Technologies, Inc., commonName=Starfield Services Root Certificate Authority - G2
- Serial: 067F94574BB7075D3E48965C783224AA754FED
- SHA-256: DFCC775C644DB4A33AD71293433F463C8E31057CE22CB267F9D31A0353F4FC2F
- SPKI SHA-256: B58539ECAA13921CCDB80D38D34875FDE6471C5A159D9BEEF2FA6F99983BD611
- Validity: 2015-10-22 to 2025-10-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Amazon
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2c9785a1-7f1b-43ca-9f2b-8d0c37c841b5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=eb0921ab-b374-4b25-a6a9-6ad7f77938b1, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d2817362-d44a-4ec0-ab59-1cc231311131
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootg2.amazontrust.com
- CRL DP: http://crl.rootg2.amazontrust.com/rootg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:7f:94:57:4b:b7:07:5d:3e:48:96:5c:78:32:24:aa:75:4f:ed
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2
        Validity
            Not Before: Oct 22 00:00:00 2015 GMT
            Not After : Oct 19 00:00:00 2025 GMT
        Subject: C = US, O = Amazon, OU = Server CA 0A, CN = Amazon
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                97:EA:C4:22:D2:06:18:ED:85:04:FF:DC:52:C2:6E:DB:0E:06:E1:3F
            X509v3 Authority Key Identifier:
                9C:5F:00:DF:AA:01:D7:30:2B:38:88:A2:B8:6D:4A:9C:F2:11:91:83
            Authority Information Access:
                OCSP - URI:http://ocsp.rootg2.amazontrust.com
                CA Issuers - URI:http://crt.rootg2.amazontrust.com/rootg2.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootg2.amazontrust.com/rootg2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DFCC775C644DB4A33AD71293433F463C8E31057CE22CB267F9D31A0353F4FC2F
    SPKI SHA256: B58539ECAA13921CCDB80D38D34875FDE6471C5A159D9BEEF2FA6F99983BD611
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.rootg2.amazontrust.com
- AIA CA Issuers: http://crt.rootg2.amazontrust.com/rootg2.cer
- CRL Distribution Points: http://crl.rootg2.amazontrust.com/rootg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Amazon ECDSA 256 EU M01

- Subject: countryName=DE, organizationName=Amazon, commonName=Amazon ECDSA 256 EU M01
- Issuer: countryName=DE, organizationName=Amazon, commonName=Amazon ECDSA 256 Root EU M1
- Serial: 07C0CD7F8F1C9F5B80116C82CF68A5C7B31F25
- SHA-256: 47DD281DDF5C7410B6F5722CC16C117776BEF8D52E9EAA22B404EC00B53E76FB
- SPKI SHA-256: 90CB0BEFE19F96781F9AD67075C3CCDD5554583555609A47DB6AAEC1BFF28C8B
- Validity: 2024-11-14 to 2032-11-14
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ffc2cba4-ab1a-4f7b-af96-9607dd7cae98, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7bc93007-2ea2-47a4-909f-56b015703934, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=88d88042-b82d-4307-97f3-5ee151aeadfa, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=73520ed1-f83f-48be-9cb6-2831ed6cbb30, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1391d859-d8b4-4c2d-bb91-20f22fcca71d, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2aa980c4-f5fb-4bfb-9da1-a006eaf4c611
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.e2m01.eu.amazontrust.com/e2m01eu.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://eue2m1.ocsp.root.eu.amazontrust.com
- CRL DP: http://eue2m1.crl.root.eu.amazontrust.com/eue2m1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:c0:cd:7f:8f:1c:9f:5b:80:11:6c:82:cf:68:a5:c7:b3:1f:25
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = DE, O = Amazon, CN = Amazon ECDSA 256 Root EU M1
        Validity
            Not Before: Nov 14 12:48:29 2024 GMT
            Not After : Nov 14 12:48:29 2032 GMT
        Subject: C = DE, O = Amazon, CN = Amazon ECDSA 256 EU M01
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                D6:75:02:35:C1:5A:89:A8:82:C6:07:07:24:31:9E:48:DE:28:82:A9
            X509v3 Authority Key Identifier:
                71:D1:7F:72:D9:B8:19:2D:F0:11:A5:CD:B5:86:4F:6E:1F:DD:E5:A2
            Authority Information Access:
                OCSP - URI:http://eue2m1.ocsp.root.eu.amazontrust.com
                CA Issuers - URI:http://eue2m1.crt.root.eu.amazontrust.com/eue2m1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://eue2m1.crl.root.eu.amazontrust.com/eue2m1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 47DD281DDF5C7410B6F5722CC16C117776BEF8D52E9EAA22B404EC00B53E76FB
    SPKI SHA256: 90CB0BEFE19F96781F9AD67075C3CCDD5554583555609A47DB6AAEC1BFF28C8B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://eue2m1.ocsp.root.eu.amazontrust.com
- AIA CA Issuers: http://eue2m1.crt.root.eu.amazontrust.com/eue2m1.crt
- CRL Distribution Points: http://eue2m1.crl.root.eu.amazontrust.com/eue2m1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 EU S00

- Subject: Amazon ECDSA 256 EU S00
- Issuer: Amazon ECDSA 256 Root EU M1
- Serial: -
- SHA-256: BC38993AA14B49931877623D95E9394F6C1AE2D32DC5FEC2E8B7259FED99CD24
- SPKI SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
- Validity: 2025-10-01 to 2033-09-29
- Key: unknown
- Signature Algorithm: -

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-01.r1.ica.amznts.eu/e2s00/a31e511c-82bc-42b8-9399-ebca1f823852.crl, http://crl-01.r1.ica.amznts.eu/e2s00/3KAxFBNvHxJ.crl, http://crl-01.r1.ica.amznts.eu/e2s00/FyLwY4xanRs.crl, http://crl-01.r1.ica.amznts.eu/e2s00/5PiFldyPgvo.crl, http://crl-01.r1.ica.amznts.eu/e2s00/7HHnx137soE.crl, http://crl-01.r1.ica.amznts.eu/e2s00/80mxq8OCacL.crl, http://crl-01.r1.ica.amznts.eu/e2s00/97AzuVyskeb.crl, http://crl-01.r1.ica.amznts.eu/e2s00/9jgmRfiSMwN.crl, http://crl-01.r1.ica.amznts.eu/e2s00/AKX2c4rOk6a.crl, http://crl-01.r1.ica.amznts.eu/e2s00/BbQF7cYoku6.crl, http://crl-01.r1.ica.amznts.eu/e2s00/BeotocVBnTP.crl, http://crl-01.r1.ica.amznts.eu/e2s00/CVqjOOR7pFo.crl, http://crl-01.r1.ica.amznts.eu/e2s00/G4uC1tcuiY8.crl, http://crl-01.r1.ica.amznts.eu/e2s00/LUmTKm9vT49.crl, http://crl-01.r1.ica.amznts.eu/e2s00/LpxNNdmZcjH.crl, http://crl-01.r1.ica.amznts.eu/e2s00/2iAWwuEvMEg.crl, http://crl-01.r1.ica.amznts.eu/e2s00/4aBWUPNr2IE.crl, http://crl-01.r1.ica.amznts.eu/e2s00/8KaCtxeAPuI.crl, http://crl-01.r1.ica.amznts.eu/e2s00/98Qo9Zl6ehQ.crl, http://crl-01.r1.ica.amznts.eu/e2s00/AEkPkV6qPxO.crl, http://crl-01.r1.ica.amznts.eu/e2s00/In59fpXfwp0.crl, http://crl-01.r1.ica.amznts.eu/e2s00/IsDyfPUXlgn.crl, http://crl-01.r1.ica.amznts.eu/e2s00/1ycR8lV3Lix.crl, http://crl-01.r1.ica.amznts.eu/e2s00/ALpp7ln5bWd.crl, http://crl-01.r1.ica.amznts.eu/e2s00/CY6L7w6cmOv.crl, http://crl-01.r1.ica.amznts.eu/e2s00/KtepFvw3xqV.crl, http://crl-01.r1.ica.amznts.eu/e2s00/92HV4SVc2P3.crl, http://crl-01.r1.ica.amznts.eu/e2s00/LNmJlawn2VH.crl, http://crl-01.r1.ica.amznts.eu/e2s00/ysyJMwEj2W.crl, http://crl-01.r1.ica.amznts.eu/e2s00/6tTcO346Lzd.crl, http://crl-01.r1.ica.amznts.eu/e2s00/C6j9LyEUEBF.crl, http://crl-01.r1.ica.amznts.eu/e2s00/CaM33bJyFJZ.crl, http://crl-01.r1.ica.amznts.eu/e2s00/HdKODo7vR3d.crl, http://crl-01.r1.ica.amznts.eu/e2s00/I9FtwCnDkWk.crl, http://crl-01.r1.ica.amznts.eu/e2s00/leQaQvYff0.crl, http://crl-01.r1.ica.amznts.eu/e2s00/B8AUazbIzYT.crl, http://crl-01.r1.ica.amznts.eu/e2s00/CThQfEpopeh.crl, http://crl-01.r1.ica.amznts.eu/e2s00/JEGwWyVryjX.crl, http://crl-01.r1.ica.amznts.eu/e2s00/E2dE0PLaJd2.crl, http://crl-01.r1.ica.amznts.eu/e2s00/8SYdSh6jFp3.crl, http://crl-01.r1.ica.amznts.eu/e2s00/AEfWld03V2K.crl, http://crl-01.r1.ica.amznts.eu/e2s00/L5xu557e6Y7.crl, http://crl-01.r1.ica.amznts.eu/e2s00/EqKJWLqCo2m.crl, http://crl-01.r1.ica.amznts.eu/e2s00/1AYuPm3tzy8.crl, http://crl-01.r1.ica.amznts.eu/e2s00/Gyib6qNKKpc.crl, http://crl-01.r1.ica.amznts.eu/e2s00/KMOCihcTzvT.crl, http://crl-01.r1.ica.amznts.eu/e2s00/K6eLu1MgpRJ.crl, http://crl-01.r1.ica.amznts.eu/e2s00/LWmHbI1PVgX.crl, http://crl-01.r1.ica.amznts.eu/e2s00/1SxpDesOP8T.crl, http://crl-01.r1.ica.amznts.eu/e2s00/E7nlDQVgNEC.crl, http://crl-01.r1.ica.amznts.eu/e2s00/SLLzHDCM86.crl, http://crl-01.r1.ica.amznts.eu/e2s00/5jXARLpi20T.crl, http://crl-01.r1.ica.amznts.eu/e2s00/48keWebzbQ0.crl, http://crl-01.r1.ica.amznts.eu/e2s00/AkAE1XXdl1U.crl, http://crl-01.r1.ica.amznts.eu/e2s00/EmN6hBhdWGt.crl, http://crl-01.r1.ica.amznts.eu/e2s00/9Fbw0zlfhxT.crl, http://crl-01.r1.ica.amznts.eu/e2s00/ASP4FG1zJuR.crl, http://crl-01.r1.ica.amznts.eu/e2s00/7FaTfiZfWE0.crl, http://crl-01.r1.ica.amznts.eu/e2s00/FyCfZnQ9bw2.crl, http://crl-01.r1.ica.amznts.eu/e2s00/GBiiIVWhUGL.crl, http://crl-01.r1.ica.amznts.eu/e2s00/8VE2QQKCqxi.crl, http://crl-01.r1.ica.amznts.eu/e2s00/CYdxHgUJqjZ.crl, http://crl-01.r1.ica.amznts.eu/e2s00/I3kGYxnDgTq.crl, http://crl-01.r1.ica.amznts.eu/e2s00/GWp7MB7xiUZ.crl, http://crl-01.r1.ica.amznts.eu/e2s00/Isaeo2eQWDE.crl, http://crl-01.r1.ica.amznts.eu/e2s00/AVsUcAkGx0c.crl, http://crl-01.r1.ica.amznts.eu/e2s00/3ofIPA9qRiQ.crl, http://crl-01.r1.ica.amznts.eu/e2s00/G1zu45piQgr.crl, http://crl-01.r1.ica.amznts.eu/e2s00/KcbwnMM9ots.crl, http://crl-01.r1.ica.amznts.eu/e2s00/DmDXUaE0jTm.crl, http://crl-01.r1.ica.amznts.eu/e2s00/1y9qhnliNCy.crl, http://crl-01.r1.ica.amznts.eu/e2s00/BwRk7dAgItr.crl, http://crl-01.r1.ica.amznts.eu/e2s00/CKfT0v2cfI2.crl, http://crl-01.r1.ica.amznts.eu/e2s00/5ISxnBlSb1n.crl, http://crl-01.r1.ica.amznts.eu/e2s00/7kVDa05KbEF.crl, http://crl-01.r1.ica.amznts.eu/e2s00/FSAmb6WvE7c.crl, http://crl-01.r1.ica.amznts.eu/e2s00/2ze0l3TN4X9.crl, http://crl-01.r1.ica.amznts.eu/e2s00/1frEibITPSj.crl, http://crl-01.r1.ica.amznts.eu/e2s00/DfhQAZ9fldk.crl, http://crl-01.r1.ica.amznts.eu/e2s00/Ebi9GYhRonY.crl, http://crl-01.r1.ica.amznts.eu/e2s00/3ZpKH4d5KEQ.crl, http://crl-01.r1.ica.amznts.eu/e2s00/523KBfJfjtT.crl, http://crl-01.r1.ica.amznts.eu/e2s00/HNAbE98VRnL.crl, http://crl-01.r1.ica.amznts.eu/e2s00/8Ze7i3Bfxg1.crl, http://crl-01.r1.ica.amznts.eu/e2s00/GmniYgEBcDf.crl, http://crl-01.r1.ica.amznts.eu/e2s00/7OGAt2Q76j1.crl, http://crl-01.r1.ica.amznts.eu/e2s00/111Su56dINt.crl, http://crl-01.r1.ica.amznts.eu/e2s00/3FAE3wZnqtv.crl, http://crl-01.r1.ica.amznts.eu/e2s00/2pkT60mct5h.crl, http://crl-01.r1.ica.amznts.eu/e2s00/6OGgSuJPBZG.crl, http://crl-01.r1.ica.amznts.eu/e2s00/HbjZgQkQS6z.crl, http://crl-01.r1.ica.amznts.eu/e2s00/KU29SqZ6pyH.crl, http://crl-01.r1.ica.amznts.eu/e2s00/8a2o8StJggB.crl, http://crl-01.r1.ica.amznts.eu/e2s00/4SYFJWLd7Px.crl, http://crl-01.r1.ica.amznts.eu/e2s00/6YLTNycraPE.crl, http://crl-01.r1.ica.amznts.eu/e2s00/1P4ZoxLWYDM.crl, http://crl-01.r1.ica.amznts.eu/e2s00/A5U5yOU3wrq.crl, http://crl-01.r1.ica.amznts.eu/e2s00/AFEbcFVxGSB.crl, http://crl-01.r1.ica.amznts.eu/e2s00/KDrhEhaN6av.crl, http://crl-01.r1.ica.amznts.eu/e2s00/ajyNO6K2sl.crl, http://crl-01.r1.ica.amznts.eu/e2s00/JnZUGWocnVk.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: -
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
SHA256 Fingerprint: BC38993AA14B49931877623D95E9394F6C1AE2D32DC5FEC2E8B7259FED99CD24
SPKI SHA256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
```

#### Extensions

- Basic Constraints: {"present":false,"critical":false,"ca":false,"path_len":null}
- Key Usage: -
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- is_ca

### Amazon ECDSA 256 EU S01

- Subject: Amazon ECDSA 256 EU S01
- Issuer: Amazon ECDSA 256 Root EU M1
- Serial: -
- SHA-256: A9C3227FB1CBBD1759938EF8718FDF835C0F8B6A546928BB0B4782A570CED4E5
- SPKI SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
- Validity: 2025-10-01 to 2033-09-29
- Key: unknown
- Signature Algorithm: -

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-01.r1.ica.amznts.eu/e2s01/5ef59f41-b7b4-4b28-a385-676484f45891.crl, http://crl-01.r1.ica.amznts.eu/e2s01/1PM8zsQcLCa.crl, http://crl-01.r1.ica.amznts.eu/e2s01/7JcVs6Y2CSp.crl, http://crl-01.r1.ica.amznts.eu/e2s01/8VoSNq1Qr6X.crl, http://crl-01.r1.ica.amznts.eu/e2s01/AQMZBwKpSow.crl, http://crl-01.r1.ica.amznts.eu/e2s01/Ag209ATKUDE.crl, http://crl-01.r1.ica.amznts.eu/e2s01/BQp5PWszAqk.crl, http://crl-01.r1.ica.amznts.eu/e2s01/D3uPrKdfLKd.crl, http://crl-01.r1.ica.amznts.eu/e2s01/DUXVJgOsE4H.crl, http://crl-01.r1.ica.amznts.eu/e2s01/H0FukBv5za1.crl, http://crl-01.r1.ica.amznts.eu/e2s01/75rzESeTPbQ.crl, http://crl-01.r1.ica.amznts.eu/e2s01/8VRf7a6rzIC.crl, http://crl-01.r1.ica.amznts.eu/e2s01/CJG5RVsVMbO.crl, http://crl-01.r1.ica.amznts.eu/e2s01/Dw6qO2v6LUF.crl, http://crl-01.r1.ica.amznts.eu/e2s01/GSSdXbqPhIB.crl, http://crl-01.r1.ica.amznts.eu/e2s01/H8TQhsTqwht.crl, http://crl-01.r1.ica.amznts.eu/e2s01/I3QGurZdIyJ.crl, http://crl-01.r1.ica.amznts.eu/e2s01/JBml55oK84O.crl, http://crl-01.r1.ica.amznts.eu/e2s01/CPoe32lYZnk.crl, http://crl-01.r1.ica.amznts.eu/e2s01/CgXMXV6Zte6.crl, http://crl-01.r1.ica.amznts.eu/e2s01/DqYDu85zWbz.crl, http://crl-01.r1.ica.amznts.eu/e2s01/EngVmlUeAj.crl, http://crl-01.r1.ica.amznts.eu/e2s01/G2mZYWQSoyz.crl, http://crl-01.r1.ica.amznts.eu/e2s01/HlizDUaZCKl.crl, http://crl-01.r1.ica.amznts.eu/e2s01/LhSR64o6nqP.crl, http://crl-01.r1.ica.amznts.eu/e2s01/CIfN8Dm6ovI.crl, http://crl-01.r1.ica.amznts.eu/e2s01/6LTqW8u7ycV.crl, http://crl-01.r1.ica.amznts.eu/e2s01/1EK8Q7wspwT.crl, http://crl-01.r1.ica.amznts.eu/e2s01/2XrxU2uH2HU.crl, http://crl-01.r1.ica.amznts.eu/e2s01/G7tVomZ999K.crl, http://crl-01.r1.ica.amznts.eu/e2s01/H3cjntVttP5.crl, http://crl-01.r1.ica.amznts.eu/e2s01/KK5ClOHsvXQ.crl, http://crl-01.r1.ica.amznts.eu/e2s01/CiarSqa9RIM.crl, http://crl-01.r1.ica.amznts.eu/e2s01/GmdQGOlleL0.crl, http://crl-01.r1.ica.amznts.eu/e2s01/D38IX75o7yY.crl, http://crl-01.r1.ica.amznts.eu/e2s01/BQoxVIptV1.crl, http://crl-01.r1.ica.amznts.eu/e2s01/DNsA3hgbUVD.crl, http://crl-01.r1.ica.amznts.eu/e2s01/4L9SZnDEdEu.crl, http://crl-01.r1.ica.amznts.eu/e2s01/4eabMPm167K.crl, http://crl-01.r1.ica.amznts.eu/e2s01/IWJQEPu8IiT.crl, http://crl-01.r1.ica.amznts.eu/e2s01/IRJZNINmi1M.crl, http://crl-01.r1.ica.amznts.eu/e2s01/35fQ1IXxrBN.crl, http://crl-01.r1.ica.amznts.eu/e2s01/6JmARuFrIIw.crl, http://crl-01.r1.ica.amznts.eu/e2s01/JZcfXl4TJYq.crl, http://crl-01.r1.ica.amznts.eu/e2s01/1XxZjG6a68D.crl, http://crl-01.r1.ica.amznts.eu/e2s01/KBEd0dsgKAl.crl, http://crl-01.r1.ica.amznts.eu/e2s01/KtO4QmDB8ff.crl, http://crl-01.r1.ica.amznts.eu/e2s01/LiPNHB0h7Mq.crl, http://crl-01.r1.ica.amznts.eu/e2s01/7i8CWyqPz41.crl, http://crl-01.r1.ica.amznts.eu/e2s01/2iN1EmPaV85.crl, http://crl-01.r1.ica.amznts.eu/e2s01/5PMZRDTr7cc.crl, http://crl-01.r1.ica.amznts.eu/e2s01/1EZ1xnxCJlv.crl, http://crl-01.r1.ica.amznts.eu/e2s01/DMQbMIBvzL0.crl, http://crl-01.r1.ica.amznts.eu/e2s01/IQCFQ4DRslI.crl, http://crl-01.r1.ica.amznts.eu/e2s01/JZPVhOKJWr.crl, http://crl-01.r1.ica.amznts.eu/e2s01/GvcDSivX8Kk.crl, http://crl-01.r1.ica.amznts.eu/e2s01/220xT9Kda4c.crl, http://crl-01.r1.ica.amznts.eu/e2s01/9wXM1mQq4cq.crl, http://crl-01.r1.ica.amznts.eu/e2s01/6d6sbkbavaX.crl, http://crl-01.r1.ica.amznts.eu/e2s01/7nQ45qWuqmm.crl, http://crl-01.r1.ica.amznts.eu/e2s01/EnxsskUVvHH.crl, http://crl-01.r1.ica.amznts.eu/e2s01/3GJAjIpFA6E.crl, http://crl-01.r1.ica.amznts.eu/e2s01/5IJUZM5lkzc.crl, http://crl-01.r1.ica.amznts.eu/e2s01/7X3UO0zq6kh.crl, http://crl-01.r1.ica.amznts.eu/e2s01/IEi5RtP8SB2.crl, http://crl-01.r1.ica.amznts.eu/e2s01/EcwX8pTsc06.crl, http://crl-01.r1.ica.amznts.eu/e2s01/Bbc6IrMVYI4.crl, http://crl-01.r1.ica.amznts.eu/e2s01/AKfZWfAJItI.crl, http://crl-01.r1.ica.amznts.eu/e2s01/EvQfKO44O1I.crl, http://crl-01.r1.ica.amznts.eu/e2s01/HWAPaul1tIY.crl, http://crl-01.r1.ica.amznts.eu/e2s01/JA544haWwkj.crl, http://crl-01.r1.ica.amznts.eu/e2s01/41zjBSKnyrj.crl, http://crl-01.r1.ica.amznts.eu/e2s01/Eh10Z6dRZDL.crl, http://crl-01.r1.ica.amznts.eu/e2s01/BNiO3TVjeGI.crl, http://crl-01.r1.ica.amznts.eu/e2s01/GlhozY3oUV.crl, http://crl-01.r1.ica.amznts.eu/e2s01/Hsun7MsQcjP.crl, http://crl-01.r1.ica.amznts.eu/e2s01/AIjACRRpc0D.crl, http://crl-01.r1.ica.amznts.eu/e2s01/FEV3ops2huO.crl, http://crl-01.r1.ica.amznts.eu/e2s01/9aoJtMmPMOR.crl, http://crl-01.r1.ica.amznts.eu/e2s01/4uFiYLkz2lh.crl, http://crl-01.r1.ica.amznts.eu/e2s01/KVpQZBaxlRL.crl, http://crl-01.r1.ica.amznts.eu/e2s01/7IP5S0dIAyS.crl, http://crl-01.r1.ica.amznts.eu/e2s01/KfJd6FCyu9q.crl, http://crl-01.r1.ica.amznts.eu/e2s01/LMdm5Z27Ua5.crl, http://crl-01.r1.ica.amznts.eu/e2s01/46hXc7oNzXa.crl, http://crl-01.r1.ica.amznts.eu/e2s01/Bya7E9V2pK7.crl, http://crl-01.r1.ica.amznts.eu/e2s01/9cyFX3J2r1Y.crl, http://crl-01.r1.ica.amznts.eu/e2s01/Gd6mFZWzzlt.crl, http://crl-01.r1.ica.amznts.eu/e2s01/LnUfkgqHbQK.crl, http://crl-01.r1.ica.amznts.eu/e2s01/Fr9siOEfoGS.crl, http://crl-01.r1.ica.amznts.eu/e2s01/BedO1y9hRsY.crl, http://crl-01.r1.ica.amznts.eu/e2s01/IX0d1HGGIMt.crl, http://crl-01.r1.ica.amznts.eu/e2s01/IYZT9TMiKXG.crl, http://crl-01.r1.ica.amznts.eu/e2s01/o2Xd4sBAD6.crl, http://crl-01.r1.ica.amznts.eu/e2s01/JHsBA3gRuoP.crl, http://crl-01.r1.ica.amznts.eu/e2s01/6zYVOAvmaJk.crl, http://crl-01.r1.ica.amznts.eu/e2s01/8HhnesS17L6.crl, http://crl-01.r1.ica.amznts.eu/e2s01/HVytROIjZtQ.crl, http://crl-01.r1.ica.amznts.eu/e2s01/Jf3FutZ1J5x.crl, http://crl-01.r1.ica.amznts.eu/e2s01/1LvnFX2riWx.crl, http://crl-01.r1.ica.amznts.eu/e2s01/8ojWpLSBvv3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: -
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
SHA256 Fingerprint: A9C3227FB1CBBD1759938EF8718FDF835C0F8B6A546928BB0B4782A570CED4E5
SPKI SHA256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
```

#### Extensions

- Basic Constraints: {"present":false,"critical":false,"ca":false,"path_len":null}
- Key Usage: -
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- is_ca

### Amazon ECDSA 256 EU S02

- Subject: Amazon ECDSA 256 EU S02
- Issuer: Amazon ECDSA 256 Root EU M1
- Serial: -
- SHA-256: EF79C8327BEB51E7B3B4DBCCDEF239FCE367B1E09D35A78407000A0270BC232E
- SPKI SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
- Validity: 2025-10-01 to 2033-09-29
- Key: unknown
- Signature Algorithm: -

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-01.r1.ica.amznts.eu/e2s02/b4533891-2368-4629-9b06-85800a753898.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: -
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
SHA256 Fingerprint: EF79C8327BEB51E7B3B4DBCCDEF239FCE367B1E09D35A78407000A0270BC232E
SPKI SHA256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
```

#### Extensions

- Basic Constraints: {"present":false,"critical":false,"ca":false,"path_len":null}
- Key Usage: -
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- is_ca

### Amazon ECDSA 256 M01

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 M01
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 0773126684D577C0FCF8D3A342BEA86F94FC8F
- SHA-256: 332B101539FA89CA4E228719FE5287AB6869AF31AB21CBF110F5DD3C5994C1C7
- SPKI SHA-256: 427DAB55BC82DF04137B8ACA241F5753559A0ADC2D04DA6EB0CEDFE5E1E38FD3
- Validity: 2022-08-23 to 2030-08-23
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d960de8d-58e1-49cd-b021-b81d840df468, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2089114f-2403-404e-9861-bcfc60426e0f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf97e8d2-eb5b-4702-9635-a1e8fffb0903, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9260ceb-c627-473c-b934-7a2da4f8930b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b6f87753-9559-4ee9-a79a-517d669b7a9a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=69e3c555-0da9-4b06-a1c1-64756cddb5ac
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.e2m01.amazontrust.com/e2m01.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:73:12:66:84:d5:77:c0:fc:f8:d3:a3:42:be:a8:6f:94:fc:8f
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: Aug 23 22:31:46 2022 GMT
            Not After : Aug 23 22:31:46 2030 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 M01
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                4F:59:FC:BC:06:16:28:BF:A2:C8:DB:08:FB:CF:13:24:BA:69:42:5C
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 332B101539FA89CA4E228719FE5287AB6869AF31AB21CBF110F5DD3C5994C1C7
    SPKI SHA256: 427DAB55BC82DF04137B8ACA241F5753559A0ADC2D04DA6EB0CEDFE5E1E38FD3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 M02

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 M02
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 0773126DE2C2FAFD2C47AD88B1566E0182046D
- SHA-256: F9693255933B68159D168AA9A247DA1DC66E23C0620338EF7149E48F83B1AE79
- SPKI SHA-256: 9725D02C6FFCD6D1E436AE80B2931BF73323DAF85EDBDC7993F8AEC491E9B26B
- Validity: 2022-08-23 to 2030-08-23
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d960de8d-58e1-49cd-b021-b81d840df468, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2089114f-2403-404e-9861-bcfc60426e0f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf97e8d2-eb5b-4702-9635-a1e8fffb0903, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b6f87753-9559-4ee9-a79a-517d669b7a9a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=69e3c555-0da9-4b06-a1c1-64756cddb5ac
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.e2m02.amazontrust.com/e2m02.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:73:12:6d:e2:c2:fa:fd:2c:47:ad:88:b1:56:6e:01:82:04:6d
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: Aug 23 22:33:24 2022 GMT
            Not After : Aug 23 22:33:24 2030 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 M02
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                BB:78:9A:D7:68:33:32:9D:1A:BB:6C:FD:B1:34:4C:01:DE:CB:D0:75
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: F9693255933B68159D168AA9A247DA1DC66E23C0620338EF7149E48F83B1AE79
    SPKI SHA256: 9725D02C6FFCD6D1E436AE80B2931BF73323DAF85EDBDC7993F8AEC491E9B26B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 M03

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 M03
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 077312703D7951FD4EB2D73CAB826AFBAA080D
- SHA-256: 493E78EEE8CCA1F26E6494ED924985AF3FA9E6110EAA61C3214E8D73B4047316
- SPKI SHA-256: 11E6A7320DD8AB2E9A3762E10B6F300038470C1FDCCD9F64E1171EA6FA06C118
- Validity: 2022-08-23 to 2030-08-23
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d960de8d-58e1-49cd-b021-b81d840df468, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2089114f-2403-404e-9861-bcfc60426e0f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf97e8d2-eb5b-4702-9635-a1e8fffb0903, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9260ceb-c627-473c-b934-7a2da4f8930b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b6f87753-9559-4ee9-a79a-517d669b7a9a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=69e3c555-0da9-4b06-a1c1-64756cddb5ac
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.e2m03.amazontrust.com/e2m03.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:73:12:70:3d:79:51:fd:4e:b2:d7:3c:ab:82:6a:fb:aa:08:0d
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: Aug 23 22:33:55 2022 GMT
            Not After : Aug 23 22:33:55 2030 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 M03
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                CB:23:C3:F3:02:73:6F:BA:C1:A4:AD:F8:71:C6:10:28:16:DF:EC:BF
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 493E78EEE8CCA1F26E6494ED924985AF3FA9E6110EAA61C3214E8D73B4047316
    SPKI SHA256: 11E6A7320DD8AB2E9A3762E10B6F300038470C1FDCCD9F64E1171EA6FA06C118
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 M04

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 M04
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 07731272B752AC8ADCCB0A3027F7DFEC18424A
- SHA-256: D241192CCE57D438986723972DD6F18B5A3A3456A708E8F273D147223AB6FA5D
- SPKI SHA-256: F1D71264818E9242405D5EF5307DA5B0526E1BC4F61A4900AB7A06C1D0B8B07A
- Validity: 2022-08-23 to 2030-08-23
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d960de8d-58e1-49cd-b021-b81d840df468, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2089114f-2403-404e-9861-bcfc60426e0f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf97e8d2-eb5b-4702-9635-a1e8fffb0903, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9260ceb-c627-473c-b934-7a2da4f8930b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b6f87753-9559-4ee9-a79a-517d669b7a9a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=69e3c555-0da9-4b06-a1c1-64756cddb5ac
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.e2m04.amazontrust.com/e2m04.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:73:12:72:b7:52:ac:8a:dc:cb:0a:30:27:f7:df:ec:18:42:4a
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: Aug 23 22:34:28 2022 GMT
            Not After : Aug 23 22:34:28 2030 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 M04
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                20:76:A0:E1:59:26:ED:45:B4:02:72:19:C2:4D:AE:77:37:B4:1B:49
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: D241192CCE57D438986723972DD6F18B5A3A3456A708E8F273D147223AB6FA5D
    SPKI SHA256: F1D71264818E9242405D5EF5307DA5B0526E1BC4F61A4900AB7A06C1D0B8B07A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 M05

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 M05
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 07C94234B1B6BA0055BDAC6A7F4E8C1BC6741D
- SHA-256: 36A77659CA91702BC800B527D12A6B4FD0237D506EDBE4670FD3A56CD0AE4243
- SPKI SHA-256: 39F2551D1B91B392031FEB7822E9587093E76640B46CF2CC546E8ACC96D62CBA
- Validity: 2025-01-13 to 2033-01-13
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-01.r1.ica.amazontrust.com/crl/51fb730a-1a97-48f7-92a8-86680303afbd.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:c9:42:34:b1:b6:ba:00:55:bd:ac:6a:7f:4e:8c:1b:c6:74:1d
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: Jan 13 23:55:49 2025 GMT
            Not After : Jan 13 23:55:49 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 M05
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                AA:EC:B2:86:15:62:D5:F8:4E:9D:08:4C:8A:98:0A:49:C4:FA:1B:FD
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 36A77659CA91702BC800B527D12A6B4FD0237D506EDBE4670FD3A56CD0AE4243
    SPKI SHA256: 39F2551D1B91B392031FEB7822E9587093E76640B46CF2CC546E8ACC96D62CBA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 M06

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 M06
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 07C94234B1B8CD73CCA5CE12DAC73628AD716B
- SHA-256: 4FF1CF3F6920EEC8D5078ABBA246F198588987DC543B73CD12ABC781125CA0FE
- SPKI SHA-256: 26DC4A8860CAE0ED7D4D73C32B6D834AC3A74A9C13FBBBFCB690EB59168B9429
- Validity: 2025-01-13 to 2033-01-13
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-01.r1.ica.amazontrust.com/crl/129f0f0d-2e83-4634-af56-402aba76f7de.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:c9:42:34:b1:b8:cd:73:cc:a5:ce:12:da:c7:36:28:ad:71:6b
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: Jan 13 23:56:23 2025 GMT
            Not After : Jan 13 23:56:23 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 M06
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                74:7C:4A:31:5C:E2:1B:AE:C1:9D:F6:37:5B:5E:21:25:B9:87:CC:25
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 4FF1CF3F6920EEC8D5078ABBA246F198588987DC543B73CD12ABC781125CA0FE
    SPKI SHA256: 26DC4A8860CAE0ED7D4D73C32B6D834AC3A74A9C13FBBBFCB690EB59168B9429
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 Root EU M1

- Subject: countryName=DE, organizationName=Amazon, commonName=Amazon ECDSA 256 Root EU M1
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 7334E4712DE546CE6CEFADC5D8D12C30548C0B2A
- SHA-256: F35A8A529EE51C24078D36A00B918C5080AEDCA0611E5BE55831B4CB66F2C2F5
- SPKI SHA-256: 9565907725464BE0BFF44B1232F85EE862A9A0D99DB971BA20344AAF41431D58
- Validity: 2025-09-17 to 2033-09-15
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://eue2m1.crl.root.amznts.eu/eue2m1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            73:34:e4:71:2d:e5:46:ce:6c:ef:ad:c5:d8:d1:2c:30:54:8c:0b:2a
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: Sep 17 21:35:25 2025 GMT
            Not After : Sep 15 21:35:25 2033 GMT
        Subject: C = DE, O = Amazon, CN = Amazon ECDSA 256 Root EU M1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                71:D1:7F:72:D9:B8:19:2D:F0:11:A5:CD:B5:86:4F:6E:1F:DD:E5:A2
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: F35A8A529EE51C24078D36A00B918C5080AEDCA0611E5BE55831B4CB66F2C2F5
    SPKI SHA256: 9565907725464BE0BFF44B1232F85EE862A9A0D99DB971BA20344AAF41431D58
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S00

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S00
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 07D683B520692E42E7F4169018DFC107B193FF
- SHA-256: 6E80F9F44C2A983F16DD6A8F0AEFCA46F95586A7210DD3B77ED859FC9DB160CC
- SPKI SHA-256: FF2CB8895987F63E8B6938BE06C09A1DDA2D0F3C99E79F11D29FEF59A778AFC0
- Validity: 2025-05-28 to 2033-05-28
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:d6:83:b5:20:69:2e:42:e7:f4:16:90:18:df:c1:07:b1:93:ff
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: May 28 17:28:39 2025 GMT
            Not After : May 28 17:28:39 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S00
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                75:16:6E:40:9F:CC:A0:55:3B:21:4D:DA:F8:C8:FF:B6:EC:40:E1:1B
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 6E80F9F44C2A983F16DD6A8F0AEFCA46F95586A7210DD3B77ED859FC9DB160CC
    SPKI SHA256: FF2CB8895987F63E8B6938BE06C09A1DDA2D0F3C99E79F11D29FEF59A778AFC0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S01

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S01
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 07D683B5206AA256243ADA11DDD095CB0D5489
- SHA-256: 912D7ED2F86EAF8196C85298FE67673352B047B7394AE51C3FED20D2EEB612F4
- SPKI SHA-256: 2DD4665A1ED7CB2A42E947531FA6D2A11615BBF875843A5F8BB69367C9214723
- Validity: 2025-05-28 to 2033-05-28
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:d6:83:b5:20:6a:a2:56:24:3a:da:11:dd:d0:95:cb:0d:54:89
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: May 28 17:28:40 2025 GMT
            Not After : May 28 17:28:40 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S01
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                B6:79:5E:16:5A:E6:EE:B0:A2:39:BB:3B:6B:98:C5:59:E2:FB:4F:23
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 912D7ED2F86EAF8196C85298FE67673352B047B7394AE51C3FED20D2EEB612F4
    SPKI SHA256: 2DD4665A1ED7CB2A42E947531FA6D2A11615BBF875843A5F8BB69367C9214723
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S02

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S02
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 07D683B5206B3B71EEAFC863731F8335350ADC
- SHA-256: F8D07375A319FF5FB7F7EB9F2B1DEF77D10BF33EFA29A9A64563958A51A11687
- SPKI SHA-256: BF8353A02BB35C6A25BEE9FF23243D5FC63E759FC32EED8C567216BC19A41904
- Validity: 2025-05-28 to 2033-05-28
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:d6:83:b5:20:6b:3b:71:ee:af:c8:63:73:1f:83:35:35:0a:dc
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: May 28 17:28:54 2025 GMT
            Not After : May 28 17:28:54 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S02
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                92:0F:02:66:29:26:C8:D3:2B:DE:BE:23:6D:A8:70:A2:B5:1C:1D:B6
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: F8D07375A319FF5FB7F7EB9F2B1DEF77D10BF33EFA29A9A64563958A51A11687
    SPKI SHA256: BF8353A02BB35C6A25BEE9FF23243D5FC63E759FC32EED8C567216BC19A41904
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S03

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S03
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 07D683B5206BBEC2204C36C03C661C971C5AE8
- SHA-256: 0F4E9E2C6597A7EBC2C8A9057CD0EE0E3B8D2E0E7582D442E223D520BED9F6EB
- SPKI SHA-256: 236C5BC8B3C62CE31E8CAB045326CD38AF8BFE79231B95DFFC8352DD2C6AA0F3
- Validity: 2025-05-28 to 2033-05-28
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:d6:83:b5:20:6b:be:c2:20:4c:36:c0:3c:66:1c:97:1c:5a:e8
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: May 28 17:28:54 2025 GMT
            Not After : May 28 17:28:54 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S03
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                26:0D:A3:57:AF:F5:68:EA:2A:25:C1:2C:85:4F:2E:E2:57:6B:77:DC
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 0F4E9E2C6597A7EBC2C8A9057CD0EE0E3B8D2E0E7582D442E223D520BED9F6EB
    SPKI SHA256: 236C5BC8B3C62CE31E8CAB045326CD38AF8BFE79231B95DFFC8352DD2C6AA0F3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S04

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S04
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 07D683B5206C30484F5C6843871A576AA76205
- SHA-256: AF381D37CC376F46EAC13FF7CEDF1BB890F87E5A07754B1B0617B9D8C3BF6D79
- SPKI SHA-256: E8D133628264F8BA466001935B008B11D687F794AD8B27ED621CD0A81913C1F6
- Validity: 2025-05-28 to 2033-05-28
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:d6:83:b5:20:6c:30:48:4f:5c:68:43:87:1a:57:6a:a7:62:05
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: May 28 17:28:55 2025 GMT
            Not After : May 28 17:28:55 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S04
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                1B:99:6D:6A:38:B7:15:D3:91:85:25:C2:83:1B:EA:AA:8C:E9:18:5A
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: AF381D37CC376F46EAC13FF7CEDF1BB890F87E5A07754B1B0617B9D8C3BF6D79
    SPKI SHA256: E8D133628264F8BA466001935B008B11D687F794AD8B27ED621CD0A81913C1F6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S05

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S05
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 07D683B5206C9F79E2F69619A90D5F9C04A1D8
- SHA-256: 8BB5B3DED8B69610A54149B238A168FC6D77A2BCDB7CEF14E3158D787B039D6A
- SPKI SHA-256: F0F5A7FB266AD1077FB6318A77D7F0B825AC531E451AF0033B73FAC6C349BC20
- Validity: 2025-05-28 to 2033-05-28
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:d6:83:b5:20:6c:9f:79:e2:f6:96:19:a9:0d:5f:9c:04:a1:d8
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: May 28 17:28:55 2025 GMT
            Not After : May 28 17:28:55 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S05
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                0F:B4:24:0A:96:03:76:4B:FF:5D:2C:F9:77:42:FF:50:A6:26:EC:77
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 8BB5B3DED8B69610A54149B238A168FC6D77A2BCDB7CEF14E3158D787B039D6A
    SPKI SHA256: F0F5A7FB266AD1077FB6318A77D7F0B825AC531E451AF0033B73FAC6C349BC20
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S06

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S06
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 4AD9AAD3BB05812C49DA9510FDCC1DF9D522ACDD
- SHA-256: 46336DB73228C62C01A9D7334A978462C39F18D7A29C9B34DE4E4D952A58A2B9
- SPKI SHA-256: 2F7AC145258F4C580204EE06148F2CC3761E19401C6888AED5C6BFF66D2CEC33
- Validity: 2026-04-22 to 2029-04-21
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r1001.amazontrust.com/e2s06/03ea7bfe-350f-4307-9fe4-2c352191b020.crl, http://crl.r1001.amazontrust.com/e2s06/4cOdV62hxjo.crl, http://crl.r1001.amazontrust.com/e2s06/1531M3flT2X.crl, http://crl.r1001.amazontrust.com/e2s06/4UgEdI3dnGh.crl, http://crl.r1001.amazontrust.com/e2s06/4tVMrIgwXkI.crl, http://crl.r1001.amazontrust.com/e2s06/54GU49webv0.crl, http://crl.r1001.amazontrust.com/e2s06/FTyPLOy6HMc.crl, http://crl.r1001.amazontrust.com/e2s06/IJGXJBzLRJG.crl, http://crl.r1001.amazontrust.com/e2s06/2uJnv0qRxgr.crl, http://crl.r1001.amazontrust.com/e2s06/3wjDbkBVetm.crl, http://crl.r1001.amazontrust.com/e2s06/62ovabI8J1M.crl, http://crl.r1001.amazontrust.com/e2s06/9VoWt97bq51.crl, http://crl.r1001.amazontrust.com/e2s06/A3vkqZk84fH.crl, http://crl.r1001.amazontrust.com/e2s06/AMCZYs4aEqf.crl, http://crl.r1001.amazontrust.com/e2s06/DOZTSqHJY8N.crl, http://crl.r1001.amazontrust.com/e2s06/Jj9yiaWu2yd.crl, http://crl.r1001.amazontrust.com/e2s06/2JC4IJP6baK.crl, http://crl.r1001.amazontrust.com/e2s06/3QBNdiH0fJs.crl, http://crl.r1001.amazontrust.com/e2s06/6QFop24RaFO.crl, http://crl.r1001.amazontrust.com/e2s06/6cKA5wxl2sB.crl, http://crl.r1001.amazontrust.com/e2s06/6pyd3Xv6OH.crl, http://crl.r1001.amazontrust.com/e2s06/8WuprrA71p9.crl, http://crl.r1001.amazontrust.com/e2s06/9U9EGX2V6U1.crl, http://crl.r1001.amazontrust.com/e2s06/CsE2jmNnlqk.crl, http://crl.r1001.amazontrust.com/e2s06/D1WTPSbv4ub.crl, http://crl.r1001.amazontrust.com/e2s06/DUcvVABG59J.crl, http://crl.r1001.amazontrust.com/e2s06/DrwugVc1Rd2.crl, http://crl.r1001.amazontrust.com/e2s06/Dv1POLx0plK.crl, http://crl.r1001.amazontrust.com/e2s06/GVfh6g92M92.crl, http://crl.r1001.amazontrust.com/e2s06/H2R0xMGHHo7.crl, http://crl.r1001.amazontrust.com/e2s06/HFdJVHAgPtA.crl, http://crl.r1001.amazontrust.com/e2s06/Hdtwpswp5OU.crl, http://crl.r1001.amazontrust.com/e2s06/IWR9kqKR56y.crl, http://crl.r1001.amazontrust.com/e2s06/ImXNfTnmCBg.crl, http://crl.r1001.amazontrust.com/e2s06/JxPiNp99efP.crl, http://crl.r1001.amazontrust.com/e2s06/KLCrO5Oay6S.crl, http://crl.r1001.amazontrust.com/e2s06/KdvizsDc0vo.crl, http://crl.r1001.amazontrust.com/e2s06/Lv4YMW2UbNz.crl, http://crl.r1001.amazontrust.com/e2s06/4vudseB1t0U.crl, http://crl.r1001.amazontrust.com/e2s06/708x4L49y2F.crl, http://crl.r1001.amazontrust.com/e2s06/9SokcHWreGz.crl, http://crl.r1001.amazontrust.com/e2s06/9V0zSLwIxdl.crl, http://crl.r1001.amazontrust.com/e2s06/BHq4QRKD0X0.crl, http://crl.r1001.amazontrust.com/e2s06/D07l7SLCDL1.crl, http://crl.r1001.amazontrust.com/e2s06/Hn8IW9qaxrb.crl, http://crl.r1001.amazontrust.com/e2s06/ISL4CHNn4od.crl, http://crl.r1001.amazontrust.com/e2s06/KJgASsgJ9wc.crl, http://crl.r1001.amazontrust.com/e2s06/L7bCvi1jmnT.crl, http://crl.r1001.amazontrust.com/e2s06/Z8jMDR88up.crl, http://crl.r1001.amazontrust.com/e2s06/1UpOmW7t9Rk.crl, http://crl.r1001.amazontrust.com/e2s06/5KfOQwrJqeP.crl, http://crl.r1001.amazontrust.com/e2s06/6xG6uXn60f9.crl, http://crl.r1001.amazontrust.com/e2s06/C9v35Il8wif.crl, http://crl.r1001.amazontrust.com/e2s06/FW5F9HD4xCY.crl, http://crl.r1001.amazontrust.com/e2s06/FjNlYCWLafm.crl, http://crl.r1001.amazontrust.com/e2s06/HJNsxy7qhzU.crl, http://crl.r1001.amazontrust.com/e2s06/3p5Zc22SRMS.crl, http://crl.r1001.amazontrust.com/e2s06/58Im3zGtOYf.crl, http://crl.r1001.amazontrust.com/e2s06/6kSjUNB3ILA.crl, http://crl.r1001.amazontrust.com/e2s06/7VWcujEdU8U.crl, http://crl.r1001.amazontrust.com/e2s06/DExpp0dVo4v.crl, http://crl.r1001.amazontrust.com/e2s06/GhjUfQ8jY6.crl, http://crl.r1001.amazontrust.com/e2s06/JY4TZF1Ugc3.crl, http://crl.r1001.amazontrust.com/e2s06/K7hlud6pX1V.crl, http://crl.r1001.amazontrust.com/e2s06/WQYxL9WKBF.crl, http://crl.r1001.amazontrust.com/e2s06/2sFjray8nG1.crl, http://crl.r1001.amazontrust.com/e2s06/6chF1OSMSSn.crl, http://crl.r1001.amazontrust.com/e2s06/6qm3iZVEiJH.crl, http://crl.r1001.amazontrust.com/e2s06/78J2pNDmqZi.crl, http://crl.r1001.amazontrust.com/e2s06/1viMSikwerR.crl, http://crl.r1001.amazontrust.com/e2s06/6SbPy8uCxjX.crl, http://crl.r1001.amazontrust.com/e2s06/9Tev8y311kw.crl, http://crl.r1001.amazontrust.com/e2s06/AwlWtlAH9Pw.crl, http://crl.r1001.amazontrust.com/e2s06/GYi3XCniXZC.crl, http://crl.r1001.amazontrust.com/e2s06/Jf2M6xljAqF.crl, http://crl.r1001.amazontrust.com/e2s06/45bBtYHMNxu.crl, http://crl.r1001.amazontrust.com/e2s06/4pgWEthM7T8.crl, http://crl.r1001.amazontrust.com/e2s06/AKzgZVO2dTb.crl, http://crl.r1001.amazontrust.com/e2s06/ApLOkKObbqF.crl, http://crl.r1001.amazontrust.com/e2s06/DTFAek7Qg3l.crl, http://crl.r1001.amazontrust.com/e2s06/eOGWpwRXqN.crl, http://crl.r1001.amazontrust.com/e2s06/1zxMnWVtSts.crl, http://crl.r1001.amazontrust.com/e2s06/6LWgQPf0FSC.crl, http://crl.r1001.amazontrust.com/e2s06/8VlPMcSgA5a.crl, http://crl.r1001.amazontrust.com/e2s06/CnxQU7BPzUt.crl, http://crl.r1001.amazontrust.com/e2s06/JenxZNA2mzk.crl, http://crl.r1001.amazontrust.com/e2s06/NmGyMUeEll.crl, http://crl.r1001.amazontrust.com/e2s06/E3q8AQXQ58f.crl, http://crl.r1001.amazontrust.com/e2s06/46BYQvZZlZc.crl, http://crl.r1001.amazontrust.com/e2s06/5MR89FhVDl.crl, http://crl.r1001.amazontrust.com/e2s06/hMsNq9mkcK.crl, http://crl.r1001.amazontrust.com/e2s06/HMYQFsROAqM.crl, http://crl.r1001.amazontrust.com/e2s06/9BDaDfPDexv.crl, http://crl.r1001.amazontrust.com/e2s06/FVTmpd3ZesS.crl, http://crl.r1001.amazontrust.com/e2s06/77Zxx1m6qIH.crl, http://crl.r1001.amazontrust.com/e2s06/G8vZrvKU0fC.crl, http://crl.r1001.amazontrust.com/e2s06/Acs81Jikqhz.crl, http://crl.r1001.amazontrust.com/e2s06/32U68GlLDzA.crl, http://crl.r1001.amazontrust.com/e2s06/GdTKJDwDzCK.crl, http://crl.r1001.amazontrust.com/e2s06/3UHUkgXhbai.crl, http://crl.r1001.amazontrust.com/e2s06/6DoaMtbw3Ra.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4a:d9:aa:d3:bb:05:81:2c:49:da:95:10:fd:cc:1d:f9:d5:22:ac:dd
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Apr 22 19:25:40 2026 GMT
            Not After : Apr 21 19:25:40 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S06
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                2C:1E:13:FB:A7:51:21:46:D1:0E:CE:C8:13:1D:2E:81:1F:BE:59:0E
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 46336DB73228C62C01A9D7334A978462C39F18D7A29C9B34DE4E4D952A58A2B9
    SPKI SHA256: 2F7AC145258F4C580204EE06148F2CC3761E19401C6888AED5C6BFF66D2CEC33
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S07

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S07
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 521F06A3097AEAD1A62B097228B296FDCD93C4D6
- SHA-256: 1AD23AF3D5C1583D6F33112BA335D6F45C69657AA09C943C14CDCEE5500A7C1E
- SPKI SHA-256: F07BE2B8830B3570BFC9FA2FD2EB1E0BD7B265182F9567ACF1ED873E967CBD60
- Validity: 2026-04-22 to 2029-04-21
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r1001.amazontrust.com/e2s07/f61c0c1a-1702-440e-ad48-618ed6a210c3.crl, http://crl.r1001.amazontrust.com/e2s07/IBW73GuMIxl.crl, http://crl.r1001.amazontrust.com/e2s07/2jYvZ3AtAAQ.crl, http://crl.r1001.amazontrust.com/e2s07/5yyTlerVPJv.crl, http://crl.r1001.amazontrust.com/e2s07/9Vz7T7gvRGe.crl, http://crl.r1001.amazontrust.com/e2s07/9hYTCf0liZb.crl, http://crl.r1001.amazontrust.com/e2s07/Bcj6VxqyNgO.crl, http://crl.r1001.amazontrust.com/e2s07/ChUaUj4h0nL.crl, http://crl.r1001.amazontrust.com/e2s07/Hcpa1IqyUS9.crl, http://crl.r1001.amazontrust.com/e2s07/IlfebNlWQWE.crl, http://crl.r1001.amazontrust.com/e2s07/Is1azoD2GXJ.crl, http://crl.r1001.amazontrust.com/e2s07/JMjO5OM01d.crl, http://crl.r1001.amazontrust.com/e2s07/KpjIRqQxpsg.crl, http://crl.r1001.amazontrust.com/e2s07/Lsl7QENBiiL.crl, http://crl.r1001.amazontrust.com/e2s07/g3JQYvIxio.crl, http://crl.r1001.amazontrust.com/e2s07/1MOWWMyCZ3u.crl, http://crl.r1001.amazontrust.com/e2s07/3a9D2PHgR7v.crl, http://crl.r1001.amazontrust.com/e2s07/4yXOU5WRLi0.crl, http://crl.r1001.amazontrust.com/e2s07/5o9SmzVVEbv.crl, http://crl.r1001.amazontrust.com/e2s07/6jdowX3N9EB.crl, http://crl.r1001.amazontrust.com/e2s07/7fGlAX0oqpB.crl, http://crl.r1001.amazontrust.com/e2s07/7zU3GPAc8Sx.crl, http://crl.r1001.amazontrust.com/e2s07/8QqWzCFACxf.crl, http://crl.r1001.amazontrust.com/e2s07/91MwYKBwRvl.crl, http://crl.r1001.amazontrust.com/e2s07/97JlzV6dpFf.crl, http://crl.r1001.amazontrust.com/e2s07/9Q4fcYRRYh5.crl, http://crl.r1001.amazontrust.com/e2s07/9Qym5TB4eVK.crl, http://crl.r1001.amazontrust.com/e2s07/BiKZKOeGGa6.crl, http://crl.r1001.amazontrust.com/e2s07/DTJtio9aYTE.crl, http://crl.r1001.amazontrust.com/e2s07/ELEPsV7JBxC.crl, http://crl.r1001.amazontrust.com/e2s07/EUURtU6yjjB.crl, http://crl.r1001.amazontrust.com/e2s07/F0z63CFhcOC.crl, http://crl.r1001.amazontrust.com/e2s07/FKd6w7AW2Kr.crl, http://crl.r1001.amazontrust.com/e2s07/J4jK1vmyoTD.crl, http://crl.r1001.amazontrust.com/e2s07/KGdnnA9orSE.crl, http://crl.r1001.amazontrust.com/e2s07/LViCaC2hbz.crl, http://crl.r1001.amazontrust.com/e2s07/3Kr2dLJHWpK.crl, http://crl.r1001.amazontrust.com/e2s07/4YoHiMNGAQ9.crl, http://crl.r1001.amazontrust.com/e2s07/4ka0AmL5gzE.crl, http://crl.r1001.amazontrust.com/e2s07/6fR07NwSsfU.crl, http://crl.r1001.amazontrust.com/e2s07/7cyRaLrEpDr.crl, http://crl.r1001.amazontrust.com/e2s07/DImWqWvRQon.crl, http://crl.r1001.amazontrust.com/e2s07/DSTe6zpmbKk.crl, http://crl.r1001.amazontrust.com/e2s07/F5sB72PJc5w.crl, http://crl.r1001.amazontrust.com/e2s07/GPHjjzybjcV.crl, http://crl.r1001.amazontrust.com/e2s07/I804vw85cc2.crl, http://crl.r1001.amazontrust.com/e2s07/6CxZzsCAx5w.crl, http://crl.r1001.amazontrust.com/e2s07/7UdM8V6rGTb.crl, http://crl.r1001.amazontrust.com/e2s07/8AUKTMvnMpN.crl, http://crl.r1001.amazontrust.com/e2s07/AZaBGdJmKnl.crl, http://crl.r1001.amazontrust.com/e2s07/DfOsosFjFsT.crl, http://crl.r1001.amazontrust.com/e2s07/Ehif8pB10X1.crl, http://crl.r1001.amazontrust.com/e2s07/Fpuwcmtv7ak.crl, http://crl.r1001.amazontrust.com/e2s07/H30vxSIB6W4.crl, http://crl.r1001.amazontrust.com/e2s07/KHUyrPrOfVI.crl, http://crl.r1001.amazontrust.com/e2s07/1KIXxAE4PTT.crl, http://crl.r1001.amazontrust.com/e2s07/1oVfCMom23g.crl, http://crl.r1001.amazontrust.com/e2s07/4M8zfJet5wB.crl, http://crl.r1001.amazontrust.com/e2s07/6y7gtAJqI2e.crl, http://crl.r1001.amazontrust.com/e2s07/6zo2VXPm6lN.crl, http://crl.r1001.amazontrust.com/e2s07/83wwKUOJxPw.crl, http://crl.r1001.amazontrust.com/e2s07/8TIf1FEyPw2.crl, http://crl.r1001.amazontrust.com/e2s07/D0147B45SQm.crl, http://crl.r1001.amazontrust.com/e2s07/DQZ8u67wl0m.crl, http://crl.r1001.amazontrust.com/e2s07/1SAajjoEG0B.crl, http://crl.r1001.amazontrust.com/e2s07/4G9fxiUM9RZ.crl, http://crl.r1001.amazontrust.com/e2s07/9yG7Oa5QfUh.crl, http://crl.r1001.amazontrust.com/e2s07/FcFR4rhewDl.crl, http://crl.r1001.amazontrust.com/e2s07/FjHNlYaHiV6.crl, http://crl.r1001.amazontrust.com/e2s07/QdV4AQhh4C.crl, http://crl.r1001.amazontrust.com/e2s07/3J3gP5dAeUh.crl, http://crl.r1001.amazontrust.com/e2s07/4vC6Wu69zAR.crl, http://crl.r1001.amazontrust.com/e2s07/7bGeRq4dIA2.crl, http://crl.r1001.amazontrust.com/e2s07/9nABuMVvxLz.crl, http://crl.r1001.amazontrust.com/e2s07/KXBFDV1XjMF.crl, http://crl.r1001.amazontrust.com/e2s07/8z88qSLslgZ.crl, http://crl.r1001.amazontrust.com/e2s07/9fVPMcyWKEc.crl, http://crl.r1001.amazontrust.com/e2s07/AvlH66jivx7.crl, http://crl.r1001.amazontrust.com/e2s07/DYNS4xtVYJ4.crl, http://crl.r1001.amazontrust.com/e2s07/GU0KxalikMp.crl, http://crl.r1001.amazontrust.com/e2s07/KOfTDkVSPVt.crl, http://crl.r1001.amazontrust.com/e2s07/LTkrVoK9eJo.crl, http://crl.r1001.amazontrust.com/e2s07/B2fBrQ5bOLz.crl, http://crl.r1001.amazontrust.com/e2s07/LuQ3Atc9FE6.crl, http://crl.r1001.amazontrust.com/e2s07/5ynjhZEKjAa.crl, http://crl.r1001.amazontrust.com/e2s07/B81INiMU6qj.crl, http://crl.r1001.amazontrust.com/e2s07/Clx7KApraNL.crl, http://crl.r1001.amazontrust.com/e2s07/G8HErTcrGEb.crl, http://crl.r1001.amazontrust.com/e2s07/JWJ4TZF1ibl.crl, http://crl.r1001.amazontrust.com/e2s07/5kz0SByA5Jk.crl, http://crl.r1001.amazontrust.com/e2s07/9OE04q2yMvf.crl, http://crl.r1001.amazontrust.com/e2s07/5BAB2SQfShK.crl, http://crl.r1001.amazontrust.com/e2s07/98SiLpnUZ1N.crl, http://crl.r1001.amazontrust.com/e2s07/9bmmJN9BoQg.crl, http://crl.r1001.amazontrust.com/e2s07/BHGSWqPckhF.crl, http://crl.r1001.amazontrust.com/e2s07/FsBl1V9BMXb.crl, http://crl.r1001.amazontrust.com/e2s07/8h9Bmw6u8dL.crl, http://crl.r1001.amazontrust.com/e2s07/ETq2NgxxSNp.crl, http://crl.r1001.amazontrust.com/e2s07/38GPMdiami5.crl, http://crl.r1001.amazontrust.com/e2s07/CveMXcWEDxP.crl, http://crl.r1001.amazontrust.com/e2s07/FIrpNKTYrrV.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:1f:06:a3:09:7a:ea:d1:a6:2b:09:72:28:b2:96:fd:cd:93:c4:d6
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Apr 22 19:25:45 2026 GMT
            Not After : Apr 21 19:25:45 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S07
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                17:8C:96:55:A1:19:01:E2:29:E3:38:A2:02:8A:06:59:F7:5B:F2:16
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1AD23AF3D5C1583D6F33112BA335D6F45C69657AA09C943C14CDCEE5500A7C1E
    SPKI SHA256: F07BE2B8830B3570BFC9FA2FD2EB1E0BD7B265182F9567ACF1ED873E967CBD60
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S08

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S08
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 50007E3695EA1D4285B618E551AFEA98BE3864F7
- SHA-256: 29E664D95BA85246938B6C79DC542EB41A0DA3C1159C00AD5B910CAEB024B252
- SPKI SHA-256: 52E27BC741FDA3421B50DC90855E01994D8D893381DDF6503D1E3033157C54AA
- Validity: 2026-04-22 to 2029-04-21
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r2001.amazontrust.com/e2s08/05fd8d89-eb60-4a12-9928-16819779749d.crl, http://crl.r2001.amazontrust.com/e2s08/5wKSmChs9XF.crl, http://crl.r2001.amazontrust.com/e2s08/2gwOFrUZ4Re.crl, http://crl.r2001.amazontrust.com/e2s08/3ZknED8Izgr.crl, http://crl.r2001.amazontrust.com/e2s08/4KnKz40xKmr.crl, http://crl.r2001.amazontrust.com/e2s08/4wrqgrKX1pv.crl, http://crl.r2001.amazontrust.com/e2s08/6A8xYlva08k.crl, http://crl.r2001.amazontrust.com/e2s08/6W7Tt9XfD1n.crl, http://crl.r2001.amazontrust.com/e2s08/89cAQZA0t6E.crl, http://crl.r2001.amazontrust.com/e2s08/97bbYmI3kMS.crl, http://crl.r2001.amazontrust.com/e2s08/A5ZCvzHxFx0.crl, http://crl.r2001.amazontrust.com/e2s08/AEdMkH5VE97.crl, http://crl.r2001.amazontrust.com/e2s08/BSybpop4u4h.crl, http://crl.r2001.amazontrust.com/e2s08/C0L0ovkAZX5.crl, http://crl.r2001.amazontrust.com/e2s08/E6KxpZ3wIl.crl, http://crl.r2001.amazontrust.com/e2s08/EGmD5Roaxk0.crl, http://crl.r2001.amazontrust.com/e2s08/FQqNDGBbb3n.crl, http://crl.r2001.amazontrust.com/e2s08/FhIsNsVJDuI.crl, http://crl.r2001.amazontrust.com/e2s08/Fz7nKrxn0zQ.crl, http://crl.r2001.amazontrust.com/e2s08/GpbXqDEplgg.crl, http://crl.r2001.amazontrust.com/e2s08/IhC50mOXlqj.crl, http://crl.r2001.amazontrust.com/e2s08/J5BLhRjZnSR.crl, http://crl.r2001.amazontrust.com/e2s08/KrAEMssemGI.crl, http://crl.r2001.amazontrust.com/e2s08/MXtFRT4g6g.crl, http://crl.r2001.amazontrust.com/e2s08/NVjIMmVAOK.crl, http://crl.r2001.amazontrust.com/e2s08/1NpjBWoUVPb.crl, http://crl.r2001.amazontrust.com/e2s08/365nDNEe5Q5.crl, http://crl.r2001.amazontrust.com/e2s08/3Cd9yQflCSI.crl, http://crl.r2001.amazontrust.com/e2s08/9uADNfebdz1.crl, http://crl.r2001.amazontrust.com/e2s08/BhxwyXzvafM.crl, http://crl.r2001.amazontrust.com/e2s08/Bu0bJdPE2aZ.crl, http://crl.r2001.amazontrust.com/e2s08/Dky0DVVWpmD.crl, http://crl.r2001.amazontrust.com/e2s08/FYc5WmisBba.crl, http://crl.r2001.amazontrust.com/e2s08/I73RB18Fhz9.crl, http://crl.r2001.amazontrust.com/e2s08/hlW2aW7GpC.crl, http://crl.r2001.amazontrust.com/e2s08/2kvw7nByl6p.crl, http://crl.r2001.amazontrust.com/e2s08/7d6wXYKiYuh.crl, http://crl.r2001.amazontrust.com/e2s08/CtARwRfTtmO.crl, http://crl.r2001.amazontrust.com/e2s08/IHDd2oBzpN8.crl, http://crl.r2001.amazontrust.com/e2s08/1d3gzK5a1jb.crl, http://crl.r2001.amazontrust.com/e2s08/47Bywa6zjuL.crl, http://crl.r2001.amazontrust.com/e2s08/4HRNdfgHX6i.crl, http://crl.r2001.amazontrust.com/e2s08/5yprUrdA5QK.crl, http://crl.r2001.amazontrust.com/e2s08/6va0rRjgUYd.crl, http://crl.r2001.amazontrust.com/e2s08/7F8OMXuQ3uB.crl, http://crl.r2001.amazontrust.com/e2s08/8pHsX6smwpo.crl, http://crl.r2001.amazontrust.com/e2s08/9FYHY5nDSnV.crl, http://crl.r2001.amazontrust.com/e2s08/CuLCWgpvJkm.crl, http://crl.r2001.amazontrust.com/e2s08/GgYzP6KB7jZ.crl, http://crl.r2001.amazontrust.com/e2s08/HUbLaWftCz6.crl, http://crl.r2001.amazontrust.com/e2s08/I1K3kAu71sP.crl, http://crl.r2001.amazontrust.com/e2s08/JgX9NEkYlJp.crl, http://crl.r2001.amazontrust.com/e2s08/Jktmw7mzIMp.crl, http://crl.r2001.amazontrust.com/e2s08/K89p5smZcY2.crl, http://crl.r2001.amazontrust.com/e2s08/Li8E9OT9Gve.crl, http://crl.r2001.amazontrust.com/e2s08/ACJiAoh5Ghm.crl, http://crl.r2001.amazontrust.com/e2s08/EQiln4EdtGw.crl, http://crl.r2001.amazontrust.com/e2s08/KqnQjhz5cyA.crl, http://crl.r2001.amazontrust.com/e2s08/LYpEggexTeg.crl, http://crl.r2001.amazontrust.com/e2s08/8uuBi7z0oi6.crl, http://crl.r2001.amazontrust.com/e2s08/KXrwMQVznFN.crl, http://crl.r2001.amazontrust.com/e2s08/Ld9sRCnnhWy.crl, http://crl.r2001.amazontrust.com/e2s08/4wLRgKEj9Vk.crl, http://crl.r2001.amazontrust.com/e2s08/8IXUnv9r8CO.crl, http://crl.r2001.amazontrust.com/e2s08/AAjzkNqyBtK.crl, http://crl.r2001.amazontrust.com/e2s08/CY4UbsrBuH.crl, http://crl.r2001.amazontrust.com/e2s08/JRQBB9yNRyE.crl, http://crl.r2001.amazontrust.com/e2s08/JVShyHncJJg.crl, http://crl.r2001.amazontrust.com/e2s08/3yIDr1xSWNJ.crl, http://crl.r2001.amazontrust.com/e2s08/A7ihiZ6lwCC.crl, http://crl.r2001.amazontrust.com/e2s08/DbpcR29Qkk.crl, http://crl.r2001.amazontrust.com/e2s08/HrybsNX6gHR.crl, http://crl.r2001.amazontrust.com/e2s08/Ialttg68Ez4.crl, http://crl.r2001.amazontrust.com/e2s08/KAuEjEooqR2.crl, http://crl.r2001.amazontrust.com/e2s08/KQn1EbitqiP.crl, http://crl.r2001.amazontrust.com/e2s08/V3rZ7idCty.crl, http://crl.r2001.amazontrust.com/e2s08/1431hBwexvg.crl, http://crl.r2001.amazontrust.com/e2s08/Ca4kinu08lM.crl, http://crl.r2001.amazontrust.com/e2s08/DKcLtWxppYK.crl, http://crl.r2001.amazontrust.com/e2s08/IFnLj0ovKSg.crl, http://crl.r2001.amazontrust.com/e2s08/LBv7CqfR5Hz.crl, http://crl.r2001.amazontrust.com/e2s08/AIGohSOhs6c.crl, http://crl.r2001.amazontrust.com/e2s08/BvNg9eVgubL.crl, http://crl.r2001.amazontrust.com/e2s08/Ee9bXa2je1A.crl, http://crl.r2001.amazontrust.com/e2s08/IfoW3am0Ymq.crl, http://crl.r2001.amazontrust.com/e2s08/IsL8aOEcgaM.crl, http://crl.r2001.amazontrust.com/e2s08/5FVfgzP0a7c.crl, http://crl.r2001.amazontrust.com/e2s08/EZUr6vnTVGH.crl, http://crl.r2001.amazontrust.com/e2s08/A5DH9AZF9qk.crl, http://crl.r2001.amazontrust.com/e2s08/AGMSodVSuaf.crl, http://crl.r2001.amazontrust.com/e2s08/DKK3zIw7uj8.crl, http://crl.r2001.amazontrust.com/e2s08/IMNKPizGzLd.crl, http://crl.r2001.amazontrust.com/e2s08/IpJ8mamTTkE.crl, http://crl.r2001.amazontrust.com/e2s08/I5FI7avKt91.crl, http://crl.r2001.amazontrust.com/e2s08/9H8GDycjRoA.crl, http://crl.r2001.amazontrust.com/e2s08/7dpfJ0ti6Ec.crl, http://crl.r2001.amazontrust.com/e2s08/FCigf78v9zZ.crl, http://crl.r2001.amazontrust.com/e2s08/BHZFXtj4xBp.crl, http://crl.r2001.amazontrust.com/e2s08/EQDIYjWydN0.crl, http://crl.r2001.amazontrust.com/e2s08/Ez7N7p0TJQD.crl, http://crl.r2001.amazontrust.com/e2s08/Dt8nseLQ1ay.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            50:00:7e:36:95:ea:1d:42:85:b6:18:e5:51:af:ea:98:be:38:64:f7
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Apr 22 19:25:50 2026 GMT
            Not After : Apr 21 19:25:50 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S08
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                93:F3:70:D7:0E:39:9F:CB:30:CD:A3:DC:82:D0:9C:23:78:28:A5:BB
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 29E664D95BA85246938B6C79DC542EB41A0DA3C1159C00AD5B910CAEB024B252
    SPKI SHA256: 52E27BC741FDA3421B50DC90855E01994D8D893381DDF6503D1E3033157C54AA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S09

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S09
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 078636350B70B8B1DB116C7F2B6FE0F1814A9A0C
- SHA-256: DC327D309C2730196FABA6BDB6884EE133F1B9BFA7A5428A02352549877731C0
- SPKI SHA-256: F46BB32DB2AE6094DF2DCD1AE6D128081DEDE21475DF007268A373C707A7C697
- Validity: 2026-04-22 to 2029-04-21
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r2001.amazontrust.com/e2s09/fd099c4c-9273-4c7e-b7ca-402274f4343a.crl, http://crl.r2001.amazontrust.com/e2s09/3FPi2G7HRc8.crl, http://crl.r2001.amazontrust.com/e2s09/7GdkpR6Popc.crl, http://crl.r2001.amazontrust.com/e2s09/7pJwkkBIrR6.crl, http://crl.r2001.amazontrust.com/e2s09/BMWU9aUk7Op.crl, http://crl.r2001.amazontrust.com/e2s09/CmmkN8J6I0p.crl, http://crl.r2001.amazontrust.com/e2s09/CvM1QI6FwbY.crl, http://crl.r2001.amazontrust.com/e2s09/DSdAjrx3PCR.crl, http://crl.r2001.amazontrust.com/e2s09/DbU9PMaAc5E.crl, http://crl.r2001.amazontrust.com/e2s09/FIT5UOeNysA.crl, http://crl.r2001.amazontrust.com/e2s09/Gfj6MZIqNz.crl, http://crl.r2001.amazontrust.com/e2s09/H0ngHV9hfjG.crl, http://crl.r2001.amazontrust.com/e2s09/HVQHq144wXv.crl, http://crl.r2001.amazontrust.com/e2s09/IF91Pi9Jhdp.crl, http://crl.r2001.amazontrust.com/e2s09/J70IuuMeQhH.crl, http://crl.r2001.amazontrust.com/e2s09/KLAVLF8pcJB.crl, http://crl.r2001.amazontrust.com/e2s09/KNvwDeUI8IF.crl, http://crl.r2001.amazontrust.com/e2s09/VigYBQxAsw.crl, http://crl.r2001.amazontrust.com/e2s09/31UzKMweHdp.crl, http://crl.r2001.amazontrust.com/e2s09/4eAMQIbs3z7.crl, http://crl.r2001.amazontrust.com/e2s09/8uz3k3gi5Ne.crl, http://crl.r2001.amazontrust.com/e2s09/BT8vXskcoHN.crl, http://crl.r2001.amazontrust.com/e2s09/DP9ErhOJZYX.crl, http://crl.r2001.amazontrust.com/e2s09/EKyjMqCqNFg.crl, http://crl.r2001.amazontrust.com/e2s09/JyzjiNLQ23B.crl, http://crl.r2001.amazontrust.com/e2s09/21jn4OTUCZJ.crl, http://crl.r2001.amazontrust.com/e2s09/4BwOu5acDmm.crl, http://crl.r2001.amazontrust.com/e2s09/656ttpocBcR.crl, http://crl.r2001.amazontrust.com/e2s09/9Q5yYmN0U89.crl, http://crl.r2001.amazontrust.com/e2s09/AVBjk6eQmBn.crl, http://crl.r2001.amazontrust.com/e2s09/BgovCHc7eeO.crl, http://crl.r2001.amazontrust.com/e2s09/DEKDteOzYRV.crl, http://crl.r2001.amazontrust.com/e2s09/Ik7UK9mGGS.crl, http://crl.r2001.amazontrust.com/e2s09/25kpORZ0os1.crl, http://crl.r2001.amazontrust.com/e2s09/3aCYI3f7Gwq.crl, http://crl.r2001.amazontrust.com/e2s09/6K6ZbiK1GNO.crl, http://crl.r2001.amazontrust.com/e2s09/6vU54lzoCO1.crl, http://crl.r2001.amazontrust.com/e2s09/8vh6UV7f8og.crl, http://crl.r2001.amazontrust.com/e2s09/ARMm0bWV7Va.crl, http://crl.r2001.amazontrust.com/e2s09/FnEvQjUuPgK.crl, http://crl.r2001.amazontrust.com/e2s09/H8xpJh3N4Vk.crl, http://crl.r2001.amazontrust.com/e2s09/HQgSp5wG478.crl, http://crl.r2001.amazontrust.com/e2s09/HUATcc5wMK7.crl, http://crl.r2001.amazontrust.com/e2s09/Hui9WauWeAz.crl, http://crl.r2001.amazontrust.com/e2s09/IESeh1II1Ci.crl, http://crl.r2001.amazontrust.com/e2s09/Ipq9xzQIKSj.crl, http://crl.r2001.amazontrust.com/e2s09/JS1Xl9Blqqc.crl, http://crl.r2001.amazontrust.com/e2s09/KuY0lxJiCUd.crl, http://crl.r2001.amazontrust.com/e2s09/LvrmoOAI52L.crl, http://crl.r2001.amazontrust.com/e2s09/1EXPgpc5QpQ.crl, http://crl.r2001.amazontrust.com/e2s09/1vzs9QPF1jH.crl, http://crl.r2001.amazontrust.com/e2s09/CLtBZt1tUTE.crl, http://crl.r2001.amazontrust.com/e2s09/1uAHde9prlA.crl, http://crl.r2001.amazontrust.com/e2s09/70JVPr4PrwV.crl, http://crl.r2001.amazontrust.com/e2s09/9K7fzjg64rd.crl, http://crl.r2001.amazontrust.com/e2s09/Bt9Gy2aU80y.crl, http://crl.r2001.amazontrust.com/e2s09/HWIWXG16ELG.crl, http://crl.r2001.amazontrust.com/e2s09/LpoWLEv51XX.crl, http://crl.r2001.amazontrust.com/e2s09/AQbaBdhs8S5.crl, http://crl.r2001.amazontrust.com/e2s09/AsiwKb1LlcP.crl, http://crl.r2001.amazontrust.com/e2s09/EwEAYvDqldb.crl, http://crl.r2001.amazontrust.com/e2s09/FWUuZGabRaZ.crl, http://crl.r2001.amazontrust.com/e2s09/GxYwEjEozfM.crl, http://crl.r2001.amazontrust.com/e2s09/KcEyntiBncN.crl, http://crl.r2001.amazontrust.com/e2s09/DSbye5DIBVa.crl, http://crl.r2001.amazontrust.com/e2s09/KLwRYE4JhtH.crl, http://crl.r2001.amazontrust.com/e2s09/KRky77oWCOm.crl, http://crl.r2001.amazontrust.com/e2s09/KZGFglMxf7y.crl, http://crl.r2001.amazontrust.com/e2s09/CFrDLAqfhFh.crl, http://crl.r2001.amazontrust.com/e2s09/FhD8Kn13Xj3.crl, http://crl.r2001.amazontrust.com/e2s09/FhtMF3tukiY.crl, http://crl.r2001.amazontrust.com/e2s09/GtEfNrJRLAj.crl, http://crl.r2001.amazontrust.com/e2s09/IlZ5O2jRvg7.crl, http://crl.r2001.amazontrust.com/e2s09/JGeI7YkeWuZ.crl, http://crl.r2001.amazontrust.com/e2s09/XMNe9hnaFn.crl, http://crl.r2001.amazontrust.com/e2s09/4lLpSE91e3L.crl, http://crl.r2001.amazontrust.com/e2s09/FziSXjq4EZX.crl, http://crl.r2001.amazontrust.com/e2s09/H1Ohwncf1gG.crl, http://crl.r2001.amazontrust.com/e2s09/Dn1sO1kJYp.crl, http://crl.r2001.amazontrust.com/e2s09/6swyB07juul.crl, http://crl.r2001.amazontrust.com/e2s09/7VeJfiw1M2P.crl, http://crl.r2001.amazontrust.com/e2s09/8iM83yeXiNE.crl, http://crl.r2001.amazontrust.com/e2s09/IruVItT018R.crl, http://crl.r2001.amazontrust.com/e2s09/u7ZYbSbSh4.crl, http://crl.r2001.amazontrust.com/e2s09/1mdADrhiKAZ.crl, http://crl.r2001.amazontrust.com/e2s09/GHSj6FWWUdm.crl, http://crl.r2001.amazontrust.com/e2s09/Ge8Jbwh2EGY.crl, http://crl.r2001.amazontrust.com/e2s09/C6pLSYesWAY.crl, http://crl.r2001.amazontrust.com/e2s09/Dcd1gZSAVkv.crl, http://crl.r2001.amazontrust.com/e2s09/HwIowNH2La4.crl, http://crl.r2001.amazontrust.com/e2s09/04VoAmgpJoU.crl, http://crl.r2001.amazontrust.com/e2s09/180sjTlGSqZ.crl, http://crl.r2001.amazontrust.com/e2s09/LEBOZWJMj16.crl, http://crl.r2001.amazontrust.com/e2s09/9Rh9dPiApEo.crl, http://crl.r2001.amazontrust.com/e2s09/CeNqWAuwyJV.crl, http://crl.r2001.amazontrust.com/e2s09/CG2klNhVnr9.crl, http://crl.r2001.amazontrust.com/e2s09/LriD8dzGM1A.crl, http://crl.r2001.amazontrust.com/e2s09/JpQid2Hk8NJ.crl, http://crl.r2001.amazontrust.com/e2s09/9Gv8U3YAimp.crl, http://crl.r2001.amazontrust.com/e2s09/8wJchUKbCPM.crl, http://crl.r2001.amazontrust.com/e2s09/3hnBnwMohd8.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:86:36:35:0b:70:b8:b1:db:11:6c:7f:2b:6f:e0:f1:81:4a:9a:0c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Apr 22 19:25:55 2026 GMT
            Not After : Apr 21 19:25:55 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S09
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                43:5A:96:5A:7A:8C:66:27:AA:05:62:69:3A:2B:72:D7:74:F4:75:D0
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: DC327D309C2730196FABA6BDB6884EE133F1B9BFA7A5428A02352549877731C0
    SPKI SHA256: F46BB32DB2AE6094DF2DCD1AE6D128081DEDE21475DF007268A373C707A7C697
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S10

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S10
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 2DDE07212DF0256E6552E921C8D63E80F16086A0
- SHA-256: 0C8BD43FFC55FA1E704F443A4EF09E1B77425006EF4918BE4714CBCD8DE82EC4
- SPKI SHA-256: F3620F9EF9C1CF0BBFA095B30C79499D643021E4DC8F62925331F8D7D042E84F
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2d:de:07:21:2d:f0:25:6e:65:52:e9:21:c8:d6:3e:80:f1:60:86:a0
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:29:44 2026 GMT
            Not After : Jul  7 19:29:44 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S10
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                80:9A:25:66:FE:C2:DB:BB:76:D1:8D:40:2E:7B:EF:8A:60:2D:C9:29
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 0C8BD43FFC55FA1E704F443A4EF09E1B77425006EF4918BE4714CBCD8DE82EC4
    SPKI SHA256: F3620F9EF9C1CF0BBFA095B30C79499D643021E4DC8F62925331F8D7D042E84F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S11

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S11
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 1D7A0C1E89461352AB815B91D54119D70A4D4F26
- SHA-256: 5A92CB16F3C70B3F64DE8D1FC8FBC8C2517EACC7438C3E7506CCB1C4A22A722D
- SPKI SHA-256: 9017921C82035A64D5EBE0E360AFB476E1FC9E71DF0EEB1CB30197FC3FE61727
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1d:7a:0c:1e:89:46:13:52:ab:81:5b:91:d5:41:19:d7:0a:4d:4f:26
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:29:49 2026 GMT
            Not After : Jul  7 19:29:49 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S11
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                B3:98:B4:74:2C:A2:B0:B3:6B:93:FF:33:61:83:62:43:2B:4C:8E:54
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5A92CB16F3C70B3F64DE8D1FC8FBC8C2517EACC7438C3E7506CCB1C4A22A722D
    SPKI SHA256: 9017921C82035A64D5EBE0E360AFB476E1FC9E71DF0EEB1CB30197FC3FE61727
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S12

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S12
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 6F71A2418E81FECBA6E8B5FD7098ED0EF845ED4F
- SHA-256: E71CE592A218FB4FF3EFE3CCF0BA9FA70C663F064B79D1CC631AF2D530C04E36
- SPKI SHA-256: B04C8F59522C544A375BD575AB7CFA50B1BF2D59A8F1E7A8E768119D2EA02845
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6f:71:a2:41:8e:81:fe:cb:a6:e8:b5:fd:70:98:ed:0e:f8:45:ed:4f
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:29:54 2026 GMT
            Not After : Jul  7 19:29:54 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S12
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                D5:97:77:80:2A:B9:0F:8A:E8:5A:7F:D3:65:48:AF:2A:2A:03:51:DD
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E71CE592A218FB4FF3EFE3CCF0BA9FA70C663F064B79D1CC631AF2D530C04E36
    SPKI SHA256: B04C8F59522C544A375BD575AB7CFA50B1BF2D59A8F1E7A8E768119D2EA02845
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S13

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S13
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 4D654174C27D931FEFD53140FBEDD475AB7CBA08
- SHA-256: F277D650C63B443D53800C3EAAFE5FB82D2AB7227EEEF46D800F808CAE501031
- SPKI SHA-256: F587AA806C03FD442944279428F3C86677EEAF6CCD5F4658C44C64658CF55CA4
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4d:65:41:74:c2:7d:93:1f:ef:d5:31:40:fb:ed:d4:75:ab:7c:ba:08
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:30:00 2026 GMT
            Not After : Jul  7 19:30:00 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S13
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                FC:CB:27:CD:18:63:6B:52:4C:4D:45:AD:2D:27:4D:C7:DA:A7:A5:B8
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F277D650C63B443D53800C3EAAFE5FB82D2AB7227EEEF46D800F808CAE501031
    SPKI SHA256: F587AA806C03FD442944279428F3C86677EEAF6CCD5F4658C44C64658CF55CA4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S14

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S14
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 2FE21147DD39B0D98254C33DAB2014266945C35D
- SHA-256: 4EBE3A5E0561F4F8FBC0B05E99032E7DBC9C18CA1FC07DC323DC9001E18CEB30
- SPKI SHA-256: F2CA53F7CE82D04C95C09CC2F2FA7EC157D0F8FECE09690A1AA6F1E303E6B753
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.e2s14.amazontrust.com/e511fd51-e064-4d47-a778-69ce7fc2c161.crl, http://crl.e2s14.amazontrust.com/2Ktbw.crl, http://crl.e2s14.amazontrust.com/Gd28B.crl, http://crl.e2s14.amazontrust.com/6TECi.crl, http://crl.e2s14.amazontrust.com/2KJdy.crl, http://crl.e2s14.amazontrust.com/7MOzT.crl, http://crl.e2s14.amazontrust.com/A45Sg.crl, http://crl.e2s14.amazontrust.com/BUHwb.crl, http://crl.e2s14.amazontrust.com/7In66.crl, http://crl.e2s14.amazontrust.com/3STVw.crl, http://crl.e2s14.amazontrust.com/DVjQw.crl, http://crl.e2s14.amazontrust.com/E26vC.crl, http://crl.e2s14.amazontrust.com/2cE91.crl, http://crl.e2s14.amazontrust.com/38L97.crl, http://crl.e2s14.amazontrust.com/DzU7P.crl, http://crl.e2s14.amazontrust.com/23vGt.crl, http://crl.e2s14.amazontrust.com/IZIib.crl, http://crl.e2s14.amazontrust.com/KFJa9.crl, http://crl.e2s14.amazontrust.com/CMbn8.crl, http://crl.e2s14.amazontrust.com/2Mz7v.crl, http://crl.e2s14.amazontrust.com/7N9YA.crl, http://crl.e2s14.amazontrust.com/E8VJI.crl, http://crl.e2s14.amazontrust.com/H7Dxr.crl, http://crl.e2s14.amazontrust.com/5Gvju.crl, http://crl.e2s14.amazontrust.com/ECV5Z.crl, http://crl.e2s14.amazontrust.com/FDpcU.crl, http://crl.e2s14.amazontrust.com/FMHLR.crl, http://crl.e2s14.amazontrust.com/267qN.crl, http://crl.e2s14.amazontrust.com/3S5HA.crl, http://crl.e2s14.amazontrust.com/5qBkg.crl, http://crl.e2s14.amazontrust.com/3VcmW.crl, http://crl.e2s14.amazontrust.com/6S2IM.crl, http://crl.e2s14.amazontrust.com/DHHq1.crl, http://crl.e2s14.amazontrust.com/FJ7z5.crl, http://crl.e2s14.amazontrust.com/1fdXQ.crl, http://crl.e2s14.amazontrust.com/Cdoov.crl, http://crl.e2s14.amazontrust.com/4yUPw.crl, http://crl.e2s14.amazontrust.com/KfxQV.crl, http://crl.e2s14.amazontrust.com/2a78X.crl, http://crl.e2s14.amazontrust.com/BWDac.crl, http://crl.e2s14.amazontrust.com/BtHxN.crl, http://crl.e2s14.amazontrust.com/KZqA6.crl, http://crl.e2s14.amazontrust.com/2WXcc.crl, http://crl.e2s14.amazontrust.com/274kQ.crl, http://crl.e2s14.amazontrust.com/9cM6T.crl, http://crl.e2s14.amazontrust.com/FTHZs.crl, http://crl.e2s14.amazontrust.com/F5BgQ.crl, http://crl.e2s14.amazontrust.com/BaWDn.crl, http://crl.e2s14.amazontrust.com/4MSQO.crl, http://crl.e2s14.amazontrust.com/7RDAN.crl, http://crl.e2s14.amazontrust.com/KIsQL.crl, http://crl.e2s14.amazontrust.com/4EhjJ.crl, http://crl.e2s14.amazontrust.com/JWTQv.crl, http://crl.e2s14.amazontrust.com/6lvxb.crl, http://crl.e2s14.amazontrust.com/BBK1E.crl, http://crl.e2s14.amazontrust.com/Bo3HA.crl, http://crl.e2s14.amazontrust.com/Jnbh7.crl, http://crl.e2s14.amazontrust.com/ATfaG.crl, http://crl.e2s14.amazontrust.com/G8Zki.crl, http://crl.e2s14.amazontrust.com/1qRLx.crl, http://crl.e2s14.amazontrust.com/HzkRW.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2f:e2:11:47:dd:39:b0:d9:82:54:c3:3d:ab:20:14:26:69:45:c3:5d
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: Jul  8 19:29:03 2026 GMT
            Not After : Jul  7 19:29:03 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S14
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                77:7B:41:E6:D5:34:37:91:0B:85:4C:4A:45:96:EE:BE:DD:06:B0:E7
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 4EBE3A5E0561F4F8FBC0B05E99032E7DBC9C18CA1FC07DC323DC9001E18CEB30
    SPKI SHA256: F2CA53F7CE82D04C95C09CC2F2FA7EC157D0F8FECE09690A1AA6F1E303E6B753
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S15

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S15
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 61FC4F3ED4579BD755B60A8E3FA7D626641B62C0
- SHA-256: C7D3A628187E718D9701BD318C19F8C7374FDC48BF57B1B3AB269CA5330EDF92
- SPKI SHA-256: C4230C611DE02454278ADA43B46CA0F9DF536468A70F75FEB08DB4103BB8C49F
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.e2s15.amazontrust.com/691fe8af-b18a-4b17-9c76-ec04728a56a0.crl, http://crl.e2s15.amazontrust.com/sMGzh.crl, http://crl.e2s15.amazontrust.com/Bvk7Q.crl, http://crl.e2s15.amazontrust.com/BWDT8.crl, http://crl.e2s15.amazontrust.com/4KjmP.crl, http://crl.e2s15.amazontrust.com/COkY1.crl, http://crl.e2s15.amazontrust.com/1aaw7.crl, http://crl.e2s15.amazontrust.com/KAst6.crl, http://crl.e2s15.amazontrust.com/6J9wi.crl, http://crl.e2s15.amazontrust.com/2IgWl.crl, http://crl.e2s15.amazontrust.com/6U3OH.crl, http://crl.e2s15.amazontrust.com/8E3f3.crl, http://crl.e2s15.amazontrust.com/KAobu.crl, http://crl.e2s15.amazontrust.com/903gF.crl, http://crl.e2s15.amazontrust.com/Hu6Mv.crl, http://crl.e2s15.amazontrust.com/FQBnZ.crl, http://crl.e2s15.amazontrust.com/1p5IW.crl, http://crl.e2s15.amazontrust.com/7f3od.crl, http://crl.e2s15.amazontrust.com/FnIvW.crl, http://crl.e2s15.amazontrust.com/8561a.crl, http://crl.e2s15.amazontrust.com/BdYIH.crl, http://crl.e2s15.amazontrust.com/4lpEZ.crl, http://crl.e2s15.amazontrust.com/CzuFq.crl, http://crl.e2s15.amazontrust.com/2ieJM.crl, http://crl.e2s15.amazontrust.com/A5isb.crl, http://crl.e2s15.amazontrust.com/E1pgA.crl, http://crl.e2s15.amazontrust.com/CoIdY.crl, http://crl.e2s15.amazontrust.com/7N62W.crl, http://crl.e2s15.amazontrust.com/4VnfL.crl, http://crl.e2s15.amazontrust.com/FrtlT.crl, http://crl.e2s15.amazontrust.com/5yMOY.crl, http://crl.e2s15.amazontrust.com/JYMLg.crl, http://crl.e2s15.amazontrust.com/BCJvH.crl, http://crl.e2s15.amazontrust.com/F8efd.crl, http://crl.e2s15.amazontrust.com/9FdTU.crl, http://crl.e2s15.amazontrust.com/6zQPL.crl, http://crl.e2s15.amazontrust.com/CFVTf.crl, http://crl.e2s15.amazontrust.com/CiPuy.crl, http://crl.e2s15.amazontrust.com/9XQbM.crl, http://crl.e2s15.amazontrust.com/MU9KW.crl, http://crl.e2s15.amazontrust.com/3dEJw.crl, http://crl.e2s15.amazontrust.com/3L9ZO.crl, http://crl.e2s15.amazontrust.com/4yuKr.crl, http://crl.e2s15.amazontrust.com/iF3rn.crl, http://crl.e2s15.amazontrust.com/Ji1xS.crl, http://crl.e2s15.amazontrust.com/BnqfA.crl, http://crl.e2s15.amazontrust.com/Y9fc5.crl, http://crl.e2s15.amazontrust.com/6bMXZ.crl, http://crl.e2s15.amazontrust.com/IkQOF.crl, http://crl.e2s15.amazontrust.com/2DCXX.crl, http://crl.e2s15.amazontrust.com/GdUmB.crl, http://crl.e2s15.amazontrust.com/F6IP2.crl, http://crl.e2s15.amazontrust.com/JT5kd.crl, http://crl.e2s15.amazontrust.com/Jc232.crl, http://crl.e2s15.amazontrust.com/1uT8n.crl, http://crl.e2s15.amazontrust.com/NcxuM.crl, http://crl.e2s15.amazontrust.com/242V2.crl, http://crl.e2s15.amazontrust.com/LivlL.crl, http://crl.e2s15.amazontrust.com/JUPUz.crl, http://crl.e2s15.amazontrust.com/JVzWV.crl, http://crl.e2s15.amazontrust.com/L2rT2.crl, http://crl.e2s15.amazontrust.com/5PnXz.crl, http://crl.e2s15.amazontrust.com/FsFEr.crl, http://crl.e2s15.amazontrust.com/JC0vP.crl, http://crl.e2s15.amazontrust.com/3Plkx.crl, http://crl.e2s15.amazontrust.com/5pRbA.crl, http://crl.e2s15.amazontrust.com/Ii3ws.crl, http://crl.e2s15.amazontrust.com/9fhRH.crl, http://crl.e2s15.amazontrust.com/J8bUj.crl, http://crl.e2s15.amazontrust.com/6i2ns.crl, http://crl.e2s15.amazontrust.com/6FKD2.crl, http://crl.e2s15.amazontrust.com/6xIBv.crl, http://crl.e2s15.amazontrust.com/Erozx.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:fc:4f:3e:d4:57:9b:d7:55:b6:0a:8e:3f:a7:d6:26:64:1b:62:c0
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: Jul  8 19:29:09 2026 GMT
            Not After : Jul  7 19:29:09 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S15
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                C1:0C:17:18:FD:E3:EF:0E:E0:DE:7E:6B:56:C7:B0:3D:30:5E:54:7E
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: C7D3A628187E718D9701BD318C19F8C7374FDC48BF57B1B3AB269CA5330EDF92
    SPKI SHA256: C4230C611DE02454278ADA43B46CA0F9DF536468A70F75FEB08DB4103BB8C49F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S16

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S16
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 4EE564192C9EDF410243799F554620564D31CE81
- SHA-256: CB57ABC4A4469CC60165E64FBD3D1F74EC92DC7A8B9F105245365526E8092C41
- SPKI SHA-256: 9601ACCB73C968614A9A596B893C315CFD568EF25057367B0E4E6BF7F34EAF62
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.e2s16.amazontrust.com/04b16586-5a58-4c2e-a455-efc4ef208c41.crl, http://crl.e2s16.amazontrust.com/B8qpV.crl, http://crl.e2s16.amazontrust.com/27kRD.crl, http://crl.e2s16.amazontrust.com/1sdg0.crl, http://crl.e2s16.amazontrust.com/5SXaM.crl, http://crl.e2s16.amazontrust.com/7CiQ9.crl, http://crl.e2s16.amazontrust.com/HUr7g.crl, http://crl.e2s16.amazontrust.com/q9n6U.crl, http://crl.e2s16.amazontrust.com/LPrNd.crl, http://crl.e2s16.amazontrust.com/4BIkV.crl, http://crl.e2s16.amazontrust.com/7a2pZ.crl, http://crl.e2s16.amazontrust.com/A59Ih.crl, http://crl.e2s16.amazontrust.com/6sTMZ.crl, http://crl.e2s16.amazontrust.com/FiX5w.crl, http://crl.e2s16.amazontrust.com/LvShR.crl, http://crl.e2s16.amazontrust.com/9t1dI.crl, http://crl.e2s16.amazontrust.com/GxgCG.crl, http://crl.e2s16.amazontrust.com/C12AG.crl, http://crl.e2s16.amazontrust.com/DdCDo.crl, http://crl.e2s16.amazontrust.com/1NqBP.crl, http://crl.e2s16.amazontrust.com/AbmvU.crl, http://crl.e2s16.amazontrust.com/HRAQ1.crl, http://crl.e2s16.amazontrust.com/4BlA0.crl, http://crl.e2s16.amazontrust.com/AiqMS.crl, http://crl.e2s16.amazontrust.com/IC4GJ.crl, http://crl.e2s16.amazontrust.com/Cwpbz.crl, http://crl.e2s16.amazontrust.com/gbZ9I.crl, http://crl.e2s16.amazontrust.com/HqwfG.crl, http://crl.e2s16.amazontrust.com/JS73E.crl, http://crl.e2s16.amazontrust.com/JogPY.crl, http://crl.e2s16.amazontrust.com/JulsK.crl, http://crl.e2s16.amazontrust.com/26CIf.crl, http://crl.e2s16.amazontrust.com/4UGEc.crl, http://crl.e2s16.amazontrust.com/IAYIU.crl, http://crl.e2s16.amazontrust.com/9Vpgy.crl, http://crl.e2s16.amazontrust.com/Ba4yW.crl, http://crl.e2s16.amazontrust.com/JOWqe.crl, http://crl.e2s16.amazontrust.com/1aOHc.crl, http://crl.e2s16.amazontrust.com/98oO2.crl, http://crl.e2s16.amazontrust.com/Uyou7.crl, http://crl.e2s16.amazontrust.com/1fJmH.crl, http://crl.e2s16.amazontrust.com/KlCwI.crl, http://crl.e2s16.amazontrust.com/ADXV2.crl, http://crl.e2s16.amazontrust.com/Hnk4R.crl, http://crl.e2s16.amazontrust.com/68Jch.crl, http://crl.e2s16.amazontrust.com/FoML2.crl, http://crl.e2s16.amazontrust.com/2xgL0.crl, http://crl.e2s16.amazontrust.com/Bnm63.crl, http://crl.e2s16.amazontrust.com/EwZVF.crl, http://crl.e2s16.amazontrust.com/96kTl.crl, http://crl.e2s16.amazontrust.com/2wW9f.crl, http://crl.e2s16.amazontrust.com/8Oo8Z.crl, http://crl.e2s16.amazontrust.com/CqKvI.crl, http://crl.e2s16.amazontrust.com/EL6kg.crl, http://crl.e2s16.amazontrust.com/Ahxha.crl, http://crl.e2s16.amazontrust.com/8j6q7.crl, http://crl.e2s16.amazontrust.com/A1KUJ.crl, http://crl.e2s16.amazontrust.com/CTnw3.crl, http://crl.e2s16.amazontrust.com/CmfQI.crl, http://crl.e2s16.amazontrust.com/63cpr.crl, http://crl.e2s16.amazontrust.com/BhgvV.crl, http://crl.e2s16.amazontrust.com/GQuEo.crl, http://crl.e2s16.amazontrust.com/9gTPf.crl, http://crl.e2s16.amazontrust.com/9YZRA.crl, http://crl.e2s16.amazontrust.com/4cgmf.crl, http://crl.e2s16.amazontrust.com/LgtUf.crl, http://crl.e2s16.amazontrust.com/J3Nvx.crl, http://crl.e2s16.amazontrust.com/I1IhC.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4e:e5:64:19:2c:9e:df:41:02:43:79:9f:55:46:20:56:4d:31:ce:81
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: Jul  8 19:29:14 2026 GMT
            Not After : Jul  7 19:29:14 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S16
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                B7:E5:DD:FD:C9:9C:BD:CC:80:4E:8F:4C:41:01:FA:34:A6:43:75:79
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: CB57ABC4A4469CC60165E64FBD3D1F74EC92DC7A8B9F105245365526E8092C41
    SPKI SHA256: 9601ACCB73C968614A9A596B893C315CFD568EF25057367B0E4E6BF7F34EAF62
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S17

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S17
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 19C9D816A0C19DA425D1A85BBE871AE9AD02AD00
- SHA-256: 18823FD4F48887972FFE884DFF4EF25742572C64761515E59E21F3F173385835
- SPKI SHA-256: 79A3B60989DED14476E26C50FFA260828CF259BFD42C0537152C0618AC9CFA2C
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.e2s17.amazontrust.com/63966d60-e75f-42d5-8b44-78b67060e8ba.crl, http://crl.e2s17.amazontrust.com/9PuGU.crl, http://crl.e2s17.amazontrust.com/FiLYQ.crl, http://crl.e2s17.amazontrust.com/Fviq5.crl, http://crl.e2s17.amazontrust.com/AJAv4.crl, http://crl.e2s17.amazontrust.com/Jm9US.crl, http://crl.e2s17.amazontrust.com/3t0Ox.crl, http://crl.e2s17.amazontrust.com/JcANV.crl, http://crl.e2s17.amazontrust.com/Kx32c.crl, http://crl.e2s17.amazontrust.com/JcFwI.crl, http://crl.e2s17.amazontrust.com/LuBp5.crl, http://crl.e2s17.amazontrust.com/FggBo.crl, http://crl.e2s17.amazontrust.com/Lo5sz.crl, http://crl.e2s17.amazontrust.com/6JxYv.crl, http://crl.e2s17.amazontrust.com/EDCvQ.crl, http://crl.e2s17.amazontrust.com/Cst3x.crl, http://crl.e2s17.amazontrust.com/3iR6s.crl, http://crl.e2s17.amazontrust.com/D4C8O.crl, http://crl.e2s17.amazontrust.com/6U2rY.crl, http://crl.e2s17.amazontrust.com/CXFGF.crl, http://crl.e2s17.amazontrust.com/53B7k.crl, http://crl.e2s17.amazontrust.com/3MJi0.crl, http://crl.e2s17.amazontrust.com/4etAG.crl, http://crl.e2s17.amazontrust.com/D8NbD.crl, http://crl.e2s17.amazontrust.com/EkboV.crl, http://crl.e2s17.amazontrust.com/6lHTo.crl, http://crl.e2s17.amazontrust.com/04Cg5.crl, http://crl.e2s17.amazontrust.com/DmtiE.crl, http://crl.e2s17.amazontrust.com/I5zYp.crl, http://crl.e2s17.amazontrust.com/GhQxm.crl, http://crl.e2s17.amazontrust.com/38TdU.crl, http://crl.e2s17.amazontrust.com/9EGYr.crl, http://crl.e2s17.amazontrust.com/Arvtl.crl, http://crl.e2s17.amazontrust.com/04P4O.crl, http://crl.e2s17.amazontrust.com/3mJJk.crl, http://crl.e2s17.amazontrust.com/AwkZN.crl, http://crl.e2s17.amazontrust.com/KudPb.crl, http://crl.e2s17.amazontrust.com/Ijh5Q.crl, http://crl.e2s17.amazontrust.com/9wrd2.crl, http://crl.e2s17.amazontrust.com/Jcr55.crl, http://crl.e2s17.amazontrust.com/LqMSo.crl, http://crl.e2s17.amazontrust.com/2MbKG.crl, http://crl.e2s17.amazontrust.com/73ka3.crl, http://crl.e2s17.amazontrust.com/2ffu4.crl, http://crl.e2s17.amazontrust.com/9fv7I.crl, http://crl.e2s17.amazontrust.com/IgGkP.crl, http://crl.e2s17.amazontrust.com/J5mFl.crl, http://crl.e2s17.amazontrust.com/9kiFj.crl, http://crl.e2s17.amazontrust.com/E1lJc.crl, http://crl.e2s17.amazontrust.com/Ke0EW.crl, http://crl.e2s17.amazontrust.com/Flzqk.crl, http://crl.e2s17.amazontrust.com/57Uvz.crl, http://crl.e2s17.amazontrust.com/4esGO.crl, http://crl.e2s17.amazontrust.com/BvFo1.crl, http://crl.e2s17.amazontrust.com/GyWYy.crl, http://crl.e2s17.amazontrust.com/5uFYc.crl, http://crl.e2s17.amazontrust.com/KdOXS.crl, http://crl.e2s17.amazontrust.com/YFeYJ.crl, http://crl.e2s17.amazontrust.com/3r8nP.crl, http://crl.e2s17.amazontrust.com/7hzDR.crl, http://crl.e2s17.amazontrust.com/AuHT5.crl, http://crl.e2s17.amazontrust.com/IP9jk.crl, http://crl.e2s17.amazontrust.com/3lftR.crl, http://crl.e2s17.amazontrust.com/IJgEf.crl, http://crl.e2s17.amazontrust.com/DKixV.crl, http://crl.e2s17.amazontrust.com/7rDIW.crl, http://crl.e2s17.amazontrust.com/CGRCs.crl, http://crl.e2s17.amazontrust.com/HKi5n.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            19:c9:d8:16:a0:c1:9d:a4:25:d1:a8:5b:be:87:1a:e9:ad:02:ad:00
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: Jul  8 19:29:19 2026 GMT
            Not After : Jul  7 19:29:19 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S17
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                5B:B9:0F:66:97:32:BF:24:A3:82:7E:95:84:52:B8:B4:F1:DC:31:A1
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 18823FD4F48887972FFE884DFF4EF25742572C64761515E59E21F3F173385835
    SPKI SHA256: 79A3B60989DED14476E26C50FFA260828CF259BFD42C0537152C0618AC9CFA2C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S18

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S18
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 37E6F12125C0FA7DE7541C490B90571DF4016028
- SHA-256: 447DB7FB3268D755C43AFEB355D57043083D61AB36ED42780AB014D9B375FBD3
- SPKI SHA-256: 2B019E3974875C88EBB48A28EB8E1138CCDAFFB9A641446B304A1826AAE6A761
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            37:e6:f1:21:25:c0:fa:7d:e7:54:1c:49:0b:90:57:1d:f4:01:60:28
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: Jul  8 19:29:24 2026 GMT
            Not After : Jul  7 19:29:24 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S18
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                00:C4:8F:BF:3C:53:FD:6F:4B:85:88:D7:91:86:16:B1:22:A2:04:69
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 447DB7FB3268D755C43AFEB355D57043083D61AB36ED42780AB014D9B375FBD3
    SPKI SHA256: 2B019E3974875C88EBB48A28EB8E1138CCDAFFB9A641446B304A1826AAE6A761
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S19

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S19
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 593E995230CE10D42BBA259D5225776C06880EB0
- SHA-256: 5CDC5408C7283FEA8501B0735817639531F96B5628D04411B9F72A8D8DA4D958
- SPKI SHA-256: D913B31A5DB90940588FAC97F096112050E58FD59C3303C2189363F055930D06
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            59:3e:99:52:30:ce:10:d4:2b:ba:25:9d:52:25:77:6c:06:88:0e:b0
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: Jul  8 19:29:29 2026 GMT
            Not After : Jul  7 19:29:29 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S19
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                86:62:0B:45:81:88:42:55:5B:1B:FF:6B:C7:D2:2A:E0:E8:8E:EC:86
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 5CDC5408C7283FEA8501B0735817639531F96B5628D04411B9F72A8D8DA4D958
    SPKI SHA256: D913B31A5DB90940588FAC97F096112050E58FD59C3303C2189363F055930D06
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S20

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S20
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 1A89A0C3ACDAB9F08F6521BDEF25D450BDC806F6
- SHA-256: 418EFF55D11EBBC7FAD3ED9CFEC572E3142EBB648477AB296624462171294BF6
- SPKI SHA-256: F8BCC420BEDA57D0314F7DF3BFB9B17F71E9E8B5BB40A16FCD443011F8422A41
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1a:89:a0:c3:ac:da:b9:f0:8f:65:21:bd:ef:25:d4:50:bd:c8:06:f6
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: Jul  8 19:29:34 2026 GMT
            Not After : Jul  7 19:29:34 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S20
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                9A:2C:A0:C4:C9:38:43:9C:B5:BA:42:DA:CF:19:81:3A:75:2D:99:F6
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 418EFF55D11EBBC7FAD3ED9CFEC572E3142EBB648477AB296624462171294BF6
    SPKI SHA256: F8BCC420BEDA57D0314F7DF3BFB9B17F71E9E8B5BB40A16FCD443011F8422A41
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 256 S21

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 256 S21
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Serial: 2BB8B91F33233D4C1A3007700DEAE3F2C094A7B8
- SHA-256: 050C63D41EBBF16621C8CFACE982A1FAC6F25F11B40AAD23B29098348AECE08C
- SPKI SHA-256: 3B928ED85E117DE1C50B9B3F50DE954A72FA5EB4F2C4CBC7C14D0127AED2DE91
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- CRL DP: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2b:b8:b9:1f:33:23:3d:4c:1a:30:07:70:0d:ea:e3:f2:c0:94:a7:b8
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 3
        Validity
            Not Before: Jul  8 19:29:39 2026 GMT
            Not After : Jul  7 19:29:39 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 256 S21
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                43:5A:81:1B:7B:66:8F:EE:93:C2:FB:96:B8:EF:3B:CF:E1:F7:18:AA
            X509v3 Authority Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca3.amazontrust.com
                CA Issuers - URI:http://crt.rootca3.amazontrust.com/rootca3.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca3.amazontrust.com/rootca3.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 050C63D41EBBF16621C8CFACE982A1FAC6F25F11B40AAD23B29098348AECE08C
    SPKI SHA256: 3B928ED85E117DE1C50B9B3F50DE954A72FA5EB4F2C4CBC7C14D0127AED2DE91
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca3.amazontrust.com
- AIA CA Issuers: http://crt.rootca3.amazontrust.com/rootca3.cer
- CRL Distribution Points: http://crl.rootca3.amazontrust.com/rootca3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 EU M01

- Subject: countryName=DE, organizationName=Amazon, commonName=Amazon ECDSA 384 EU M01
- Issuer: countryName=DE, organizationName=Amazon, commonName=Amazon ECDSA 384 Root EU M1
- Serial: 07C0CD7F8F1F7F0976067B9ED16C994FB630FB
- SHA-256: 99B465B7D368B80077779605069FA7A4ED9E8EBBAA2671F3D4F0D15097996E26
- SPKI SHA-256: 45493D02936C7FAFFC32884F88622517C3134676B6D67C13AB4EC8E7439ACAE2
- Validity: 2024-11-14 to 2032-11-14
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ffc2cba4-ab1a-4f7b-af96-9607dd7cae98, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7bc93007-2ea2-47a4-909f-56b015703934, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=88d88042-b82d-4307-97f3-5ee151aeadfa, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=73520ed1-f83f-48be-9cb6-2831ed6cbb30, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1391d859-d8b4-4c2d-bb91-20f22fcca71d, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2aa980c4-f5fb-4bfb-9da1-a006eaf4c611
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.e3m01.eu.amazontrust.com/e3m01eu.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://eue3m1.ocsp.root.eu.amazontrust.com
- CRL DP: http://eue3m1.crl.root.eu.amazontrust.com/eue3m1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:c0:cd:7f:8f:1f:7f:09:76:06:7b:9e:d1:6c:99:4f:b6:30:fb
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = Amazon, CN = Amazon ECDSA 384 Root EU M1
        Validity
            Not Before: Nov 14 12:48:56 2024 GMT
            Not After : Nov 14 12:48:56 2032 GMT
        Subject: C = DE, O = Amazon, CN = Amazon ECDSA 384 EU M01
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                D8:0B:35:AD:D4:D7:AD:74:67:88:B5:94:71:05:42:C5:2F:C2:DE:A4
            X509v3 Authority Key Identifier:
                B1:BB:47:20:39:9A:7D:80:17:1D:A6:05:5C:18:67:0C:1B:54:A2:A8
            Authority Information Access:
                OCSP - URI:http://eue3m1.ocsp.root.eu.amazontrust.com
                CA Issuers - URI:http://eue3m1.crt.root.eu.amazontrust.com/eue3m1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://eue3m1.crl.root.eu.amazontrust.com/eue3m1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 99B465B7D368B80077779605069FA7A4ED9E8EBBAA2671F3D4F0D15097996E26
    SPKI SHA256: 45493D02936C7FAFFC32884F88622517C3134676B6D67C13AB4EC8E7439ACAE2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://eue3m1.ocsp.root.eu.amazontrust.com
- AIA CA Issuers: http://eue3m1.crt.root.eu.amazontrust.com/eue3m1.crt
- CRL Distribution Points: http://eue3m1.crl.root.eu.amazontrust.com/eue3m1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 EU S00

- Subject: Amazon ECDSA 384 EU S00
- Issuer: Amazon ECDSA 384 Root EU M1
- Serial: -
- SHA-256: A91AA45C79B99F3ABA79CC677D2BDD4623B54A3D035B37681109D7E38BA02E6C
- SPKI SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
- Validity: 2025-10-01 to 2033-09-29
- Key: unknown
- Signature Algorithm: -

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-01.r1.ica.amznts.eu/e3s00/56aab13b-675b-45d5-bf09-d4de196cc64c.crl, http://crl-01.r1.ica.amznts.eu/e3s00/2NvW5FFte01.crl, http://crl-01.r1.ica.amznts.eu/e3s00/AJIwZBkxagP.crl, http://crl-01.r1.ica.amznts.eu/e3s00/17oA9H1zT1y.crl, http://crl-01.r1.ica.amznts.eu/e3s00/1AFGL9ED89W.crl, http://crl-01.r1.ica.amznts.eu/e3s00/29WsO0BhwZV.crl, http://crl-01.r1.ica.amznts.eu/e3s00/2txTSjcW94A.crl, http://crl-01.r1.ica.amznts.eu/e3s00/32zD3e7vDQs.crl, http://crl-01.r1.ica.amznts.eu/e3s00/3mATymwpUBX.crl, http://crl-01.r1.ica.amznts.eu/e3s00/5txnaefQhm5.crl, http://crl-01.r1.ica.amznts.eu/e3s00/6oKT6fJtM17.crl, http://crl-01.r1.ica.amznts.eu/e3s00/72cGB61abca.crl, http://crl-01.r1.ica.amznts.eu/e3s00/7TLNOzS5slC.crl, http://crl-01.r1.ica.amznts.eu/e3s00/7cNrgNmubQL.crl, http://crl-01.r1.ica.amznts.eu/e3s00/812P3Qtpj5U.crl, http://crl-01.r1.ica.amznts.eu/e3s00/9bKuJNzlaO6.crl, http://crl-01.r1.ica.amznts.eu/e3s00/A5VmJg5lSdG.crl, http://crl-01.r1.ica.amznts.eu/e3s00/BtIOIgpXAUh.crl, http://crl-01.r1.ica.amznts.eu/e3s00/CK2tefI0On.crl, http://crl-01.r1.ica.amznts.eu/e3s00/F8cEt3hy42c.crl, http://crl-01.r1.ica.amznts.eu/e3s00/G4nMVmAWCEF.crl, http://crl-01.r1.ica.amznts.eu/e3s00/HqM3a6QfDw1.crl, http://crl-01.r1.ica.amznts.eu/e3s00/Krt71EmSI4h.crl, http://crl-01.r1.ica.amznts.eu/e3s00/Lmy3qDmuCkW.crl, http://crl-01.r1.ica.amznts.eu/e3s00/02rvwKWdFWX.crl, http://crl-01.r1.ica.amznts.eu/e3s00/2tRCpXC8DZs.crl, http://crl-01.r1.ica.amznts.eu/e3s00/CLdPbiyrryq.crl, http://crl-01.r1.ica.amznts.eu/e3s00/KK88Ftq0Oil.crl, http://crl-01.r1.ica.amznts.eu/e3s00/LXPDB2l1Q4S.crl, http://crl-01.r1.ica.amznts.eu/e3s00/1iyjhhgKgks.crl, http://crl-01.r1.ica.amznts.eu/e3s00/1q8lM1Hhqfo.crl, http://crl-01.r1.ica.amznts.eu/e3s00/2kpS8uABl8K.crl, http://crl-01.r1.ica.amznts.eu/e3s00/3Lar9z0l1WP.crl, http://crl-01.r1.ica.amznts.eu/e3s00/49mxuBQ3Jsp.crl, http://crl-01.r1.ica.amznts.eu/e3s00/4Oy7ULDIYGs.crl, http://crl-01.r1.ica.amznts.eu/e3s00/6uO8XhQLb4W.crl, http://crl-01.r1.ica.amznts.eu/e3s00/7C4H3NQXEq6.crl, http://crl-01.r1.ica.amznts.eu/e3s00/7GBRsFEjklF.crl, http://crl-01.r1.ica.amznts.eu/e3s00/8U3ASWdpAnF.crl, http://crl-01.r1.ica.amznts.eu/e3s00/91HqC7oStrG.crl, http://crl-01.r1.ica.amznts.eu/e3s00/99SEtvpSTO3.crl, http://crl-01.r1.ica.amznts.eu/e3s00/9O6NmkQRpfv.crl, http://crl-01.r1.ica.amznts.eu/e3s00/9USKqpkrssn.crl, http://crl-01.r1.ica.amznts.eu/e3s00/9nlV6ZDs3qq.crl, http://crl-01.r1.ica.amznts.eu/e3s00/B5p8rQO78dG.crl, http://crl-01.r1.ica.amznts.eu/e3s00/CGNlcC3Z1IY.crl, http://crl-01.r1.ica.amznts.eu/e3s00/CKlASD8APTu.crl, http://crl-01.r1.ica.amznts.eu/e3s00/DCKl88fO4gq.crl, http://crl-01.r1.ica.amznts.eu/e3s00/Ds0u7lfYEjf.crl, http://crl-01.r1.ica.amznts.eu/e3s00/FeSmwdo3vVU.crl, http://crl-01.r1.ica.amznts.eu/e3s00/Fy9hHdyDg2l.crl, http://crl-01.r1.ica.amznts.eu/e3s00/G5r9i5LCBCT.crl, http://crl-01.r1.ica.amznts.eu/e3s00/GVdVxll6x0n.crl, http://crl-01.r1.ica.amznts.eu/e3s00/HWUEqNgtbul.crl, http://crl-01.r1.ica.amznts.eu/e3s00/IHmHd43haSU.crl, http://crl-01.r1.ica.amznts.eu/e3s00/IKTwy1nZjV6.crl, http://crl-01.r1.ica.amznts.eu/e3s00/JKHBhYdct1U.crl, http://crl-01.r1.ica.amznts.eu/e3s00/K1n782smXQV.crl, http://crl-01.r1.ica.amznts.eu/e3s00/KAOGBdOnz29.crl, http://crl-01.r1.ica.amznts.eu/e3s00/LeaY7qLFoYF.crl, http://crl-01.r1.ica.amznts.eu/e3s00/LrDpQo5Tmek.crl, http://crl-01.r1.ica.amznts.eu/e3s00/LwqHlKJZNJn.crl, http://crl-01.r1.ica.amznts.eu/e3s00/1Oqq1cV6lX5.crl, http://crl-01.r1.ica.amznts.eu/e3s00/1nzrUITgtgO.crl, http://crl-01.r1.ica.amznts.eu/e3s00/2BgSar3WPQi.crl, http://crl-01.r1.ica.amznts.eu/e3s00/2oEmn0rMD7k.crl, http://crl-01.r1.ica.amznts.eu/e3s00/2rvYqPuiSPy.crl, http://crl-01.r1.ica.amznts.eu/e3s00/31Bxi3s689H.crl, http://crl-01.r1.ica.amznts.eu/e3s00/461dOZg59Tl.crl, http://crl-01.r1.ica.amznts.eu/e3s00/4Jt9l8BWMXZ.crl, http://crl-01.r1.ica.amznts.eu/e3s00/4m5jiw6ZJ2S.crl, http://crl-01.r1.ica.amznts.eu/e3s00/529jaObV7bW.crl, http://crl-01.r1.ica.amznts.eu/e3s00/52BJPwoAjNB.crl, http://crl-01.r1.ica.amznts.eu/e3s00/77ve3e9GMXM.crl, http://crl-01.r1.ica.amznts.eu/e3s00/7s5z1wgNX6n.crl, http://crl-01.r1.ica.amznts.eu/e3s00/8BEWLrZF8hV.crl, http://crl-01.r1.ica.amznts.eu/e3s00/9XT0ZjW7M0H.crl, http://crl-01.r1.ica.amznts.eu/e3s00/Abpst9oTtCk.crl, http://crl-01.r1.ica.amznts.eu/e3s00/AjcbJmlgzmd.crl, http://crl-01.r1.ica.amznts.eu/e3s00/AmiXxR7vNis.crl, http://crl-01.r1.ica.amznts.eu/e3s00/AquyCBLp4jf.crl, http://crl-01.r1.ica.amznts.eu/e3s00/CFenho7dJFH.crl, http://crl-01.r1.ica.amznts.eu/e3s00/Edbq1WuSXAk.crl, http://crl-01.r1.ica.amznts.eu/e3s00/FOZQ2lFgSzp.crl, http://crl-01.r1.ica.amznts.eu/e3s00/FxG4rqsgQrG.crl, http://crl-01.r1.ica.amznts.eu/e3s00/G1jUyL6BIN9.crl, http://crl-01.r1.ica.amznts.eu/e3s00/GKe0F9lB70D.crl, http://crl-01.r1.ica.amznts.eu/e3s00/HndDzq4kB2A.crl, http://crl-01.r1.ica.amznts.eu/e3s00/J7OhNZYMnhk.crl, http://crl-01.r1.ica.amznts.eu/e3s00/KvTnNa74ct5.crl, http://crl-01.r1.ica.amznts.eu/e3s00/LZBUU3GHfpd.crl, http://crl-01.r1.ica.amznts.eu/e3s00/LqXara66eGc.crl, http://crl-01.r1.ica.amznts.eu/e3s00/lj93NzvpJz.crl, http://crl-01.r1.ica.amznts.eu/e3s00/5GorB09FBpI.crl, http://crl-01.r1.ica.amznts.eu/e3s00/9ZqAwTsDNXR.crl, http://crl-01.r1.ica.amznts.eu/e3s00/DazP59QKnoh.crl, http://crl-01.r1.ica.amznts.eu/e3s00/IZSEUrYVb6J.crl, http://crl-01.r1.ica.amznts.eu/e3s00/1pa1dnfna7l.crl, http://crl-01.r1.ica.amznts.eu/e3s00/4P5hF4MupmL.crl, http://crl-01.r1.ica.amznts.eu/e3s00/J3n2RjaOJTz.crl, http://crl-01.r1.ica.amznts.eu/e3s00/CLzIap8zlqz.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: -
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
SHA256 Fingerprint: A91AA45C79B99F3ABA79CC677D2BDD4623B54A3D035B37681109D7E38BA02E6C
SPKI SHA256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
```

#### Extensions

- Basic Constraints: {"present":false,"critical":false,"ca":false,"path_len":null}
- Key Usage: -
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- is_ca

### Amazon ECDSA 384 EU S01

- Subject: Amazon ECDSA 384 EU S01
- Issuer: Amazon ECDSA 384 Root EU M1
- Serial: -
- SHA-256: 9A471687404FB5C3AAA5B218047A3255A41997C85B6AA8009F4C3DBEFE7A9299
- SPKI SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
- Validity: 2025-10-01 to 2033-09-29
- Key: unknown
- Signature Algorithm: -

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-01.r1.ica.amznts.eu/e3s01/04jR55Ojd0A.crl, http://crl-01.r1.ica.amznts.eu/e3s01/1rvfQGy8XHv.crl, http://crl-01.r1.ica.amznts.eu/e3s01/20eaGMOQ6vz.crl, http://crl-01.r1.ica.amznts.eu/e3s01/2CnzuaYQPo1.crl, http://crl-01.r1.ica.amznts.eu/e3s01/2XXVTFzXl2B.crl, http://crl-01.r1.ica.amznts.eu/e3s01/2au3wi3R61a.crl, http://crl-01.r1.ica.amznts.eu/e3s01/2sL0D2aw4XX.crl, http://crl-01.r1.ica.amznts.eu/e3s01/39B5NePyBP2.crl, http://crl-01.r1.ica.amznts.eu/e3s01/3R5PjD32V1J.crl, http://crl-01.r1.ica.amznts.eu/e3s01/3bP28pjmScK.crl, http://crl-01.r1.ica.amznts.eu/e3s01/3icG2lihoeU.crl, http://crl-01.r1.ica.amznts.eu/e3s01/40a9zvkIPnn.crl, http://crl-01.r1.ica.amznts.eu/e3s01/4FDJ51LomCu.crl, http://crl-01.r1.ica.amznts.eu/e3s01/4a3mwFOhmg9.crl, http://crl-01.r1.ica.amznts.eu/e3s01/4dl6DD4ksux.crl, http://crl-01.r1.ica.amznts.eu/e3s01/4kf6R2UfFbe.crl, http://crl-01.r1.ica.amznts.eu/e3s01/53dpE9KPqJH.crl, http://crl-01.r1.ica.amznts.eu/e3s01/5PJXPZsrVve.crl, http://crl-01.r1.ica.amznts.eu/e3s01/5Zs0FJvmCIQ.crl, http://crl-01.r1.ica.amznts.eu/e3s01/5w6tTQTzo7k.crl, http://crl-01.r1.ica.amznts.eu/e3s01/66V951noGiy.crl, http://crl-01.r1.ica.amznts.eu/e3s01/6MX8e1QdQzd.crl, http://crl-01.r1.ica.amznts.eu/e3s01/6Nh4Wqb3WZ4.crl, http://crl-01.r1.ica.amznts.eu/e3s01/6cb2xVKurPk.crl, http://crl-01.r1.ica.amznts.eu/e3s01/73U8dQRiqLv.crl, http://crl-01.r1.ica.amznts.eu/e3s01/75YBAjJHvkd.crl, http://crl-01.r1.ica.amznts.eu/e3s01/7amTK0P6TVM.crl, http://crl-01.r1.ica.amznts.eu/e3s01/7dZ2gAVJd7m.crl, http://crl-01.r1.ica.amznts.eu/e3s01/7jfurSCxvP4.crl, http://crl-01.r1.ica.amznts.eu/e3s01/8XqXSwZ5Oov.crl, http://crl-01.r1.ica.amznts.eu/e3s01/8qD2bzUr1St.crl, http://crl-01.r1.ica.amznts.eu/e3s01/8ycSYJiNGAb.crl, http://crl-01.r1.ica.amznts.eu/e3s01/90pLNOjArid.crl, http://crl-01.r1.ica.amznts.eu/e3s01/9NX3toytGiK.crl, http://crl-01.r1.ica.amznts.eu/e3s01/9e870043-c99a-4f9f-9a30-e083349f1bc3.crl, http://crl-01.r1.ica.amznts.eu/e3s01/A3q66JrHgeJ.crl, http://crl-01.r1.ica.amznts.eu/e3s01/ACzE17gLUf1.crl, http://crl-01.r1.ica.amznts.eu/e3s01/AyPcEyzdlXk.crl, http://crl-01.r1.ica.amznts.eu/e3s01/AyUH7SOegwo.crl, http://crl-01.r1.ica.amznts.eu/e3s01/BZllS8szsMF.crl, http://crl-01.r1.ica.amznts.eu/e3s01/BbxMTfzliPd.crl, http://crl-01.r1.ica.amznts.eu/e3s01/BmLFSHTUqo6.crl, http://crl-01.r1.ica.amznts.eu/e3s01/BwHrlewAb9K.crl, http://crl-01.r1.ica.amznts.eu/e3s01/CMi47n8EH1t.crl, http://crl-01.r1.ica.amznts.eu/e3s01/CXPvAMQgvTF.crl, http://crl-01.r1.ica.amznts.eu/e3s01/CoCldmXmJB1.crl, http://crl-01.r1.ica.amznts.eu/e3s01/CqTBIotxdi6.crl, http://crl-01.r1.ica.amznts.eu/e3s01/DjKo2D4FeZ9.crl, http://crl-01.r1.ica.amznts.eu/e3s01/E0uAXFdfAiG.crl, http://crl-01.r1.ica.amznts.eu/e3s01/EHBkdKovLDc.crl, http://crl-01.r1.ica.amznts.eu/e3s01/EjjNPZ4g8Oo.crl, http://crl-01.r1.ica.amznts.eu/e3s01/EqOGv9YCeji.crl, http://crl-01.r1.ica.amznts.eu/e3s01/F6XSq40700g.crl, http://crl-01.r1.ica.amznts.eu/e3s01/FOiIw9PXjJM.crl, http://crl-01.r1.ica.amznts.eu/e3s01/G6ITmns6ioQ.crl, http://crl-01.r1.ica.amznts.eu/e3s01/GFarL0QWh3G.crl, http://crl-01.r1.ica.amznts.eu/e3s01/GJnX8W3zH4I.crl, http://crl-01.r1.ica.amznts.eu/e3s01/GLtIY2i8z4J.crl, http://crl-01.r1.ica.amznts.eu/e3s01/GlMHGWTtJZN.crl, http://crl-01.r1.ica.amznts.eu/e3s01/Gtoi90gOBD8.crl, http://crl-01.r1.ica.amznts.eu/e3s01/H1oFnXKubPr.crl, http://crl-01.r1.ica.amznts.eu/e3s01/H1tFTDs10Pb.crl, http://crl-01.r1.ica.amznts.eu/e3s01/HCjKZkVqiwy.crl, http://crl-01.r1.ica.amznts.eu/e3s01/HlRqchVNh8W.crl, http://crl-01.r1.ica.amznts.eu/e3s01/HsdaTkvX7kn.crl, http://crl-01.r1.ica.amznts.eu/e3s01/Hv580IT1Kh0.crl, http://crl-01.r1.ica.amznts.eu/e3s01/I3dyTzQex9t.crl, http://crl-01.r1.ica.amznts.eu/e3s01/I47yP64IP2Y.crl, http://crl-01.r1.ica.amznts.eu/e3s01/I8VxULxSaG.crl, http://crl-01.r1.ica.amznts.eu/e3s01/IAGV2K6NZUd.crl, http://crl-01.r1.ica.amznts.eu/e3s01/IDpvqhXcuMU.crl, http://crl-01.r1.ica.amznts.eu/e3s01/IEAmpMtXNlJ.crl, http://crl-01.r1.ica.amznts.eu/e3s01/IPSlKRvHKb9.crl, http://crl-01.r1.ica.amznts.eu/e3s01/IVlZjAOUogA.crl, http://crl-01.r1.ica.amznts.eu/e3s01/Ikj04b9Eh1x.crl, http://crl-01.r1.ica.amznts.eu/e3s01/Iv3zRnVDDYL.crl, http://crl-01.r1.ica.amznts.eu/e3s01/IwKXBNJ0Qm5.crl, http://crl-01.r1.ica.amznts.eu/e3s01/JFcOhy8Tyhb.crl, http://crl-01.r1.ica.amznts.eu/e3s01/JKn3AyqC5Ib.crl, http://crl-01.r1.ica.amznts.eu/e3s01/JTEphwlfcpx.crl, http://crl-01.r1.ica.amznts.eu/e3s01/JqP1B9S8mOj.crl, http://crl-01.r1.ica.amznts.eu/e3s01/KJezE7re0CK.crl, http://crl-01.r1.ica.amznts.eu/e3s01/KPuZhA53G7b.crl, http://crl-01.r1.ica.amznts.eu/e3s01/KV5uF9zp4K6.crl, http://crl-01.r1.ica.amznts.eu/e3s01/KdAGI7NtZQz.crl, http://crl-01.r1.ica.amznts.eu/e3s01/KdqLhia81zk.crl, http://crl-01.r1.ica.amznts.eu/e3s01/KjlijmHFcdU.crl, http://crl-01.r1.ica.amznts.eu/e3s01/L7hsfl7ozAE.crl, http://crl-01.r1.ica.amznts.eu/e3s01/L8xjUFwkzqS.crl, http://crl-01.r1.ica.amznts.eu/e3s01/LQvGEEDqic3.crl, http://crl-01.r1.ica.amznts.eu/e3s01/LSxZo1O2z0v.crl, http://crl-01.r1.ica.amznts.eu/e3s01/LWp0HixAGyA.crl, http://crl-01.r1.ica.amznts.eu/e3s01/LZ2bu1Nvs86.crl, http://crl-01.r1.ica.amznts.eu/e3s01/LjZ97fy63pJ.crl, http://crl-01.r1.ica.amznts.eu/e3s01/Q9YYkRta3Y.crl, http://crl-01.r1.ica.amznts.eu/e3s01/YjllTO9wQr.crl, http://crl-01.r1.ica.amznts.eu/e3s01/dfDKcE1idI.crl, http://crl-01.r1.ica.amznts.eu/e3s01/yIC5wKlrQW.crl, http://crl-01.r1.ica.amznts.eu/e3s01/79c3e9INWpM.crl, http://crl-01.r1.ica.amznts.eu/e3s01/8Z7jUFgOWlT.crl, http://crl-01.r1.ica.amznts.eu/e3s01/GxPT1Q29975.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: -
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
SHA256 Fingerprint: 9A471687404FB5C3AAA5B218047A3255A41997C85B6AA8009F4C3DBEFE7A9299
SPKI SHA256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
```

#### Extensions

- Basic Constraints: {"present":false,"critical":false,"ca":false,"path_len":null}
- Key Usage: -
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- is_ca

### Amazon ECDSA 384 EU S02

- Subject: Amazon ECDSA 384 EU S02
- Issuer: Amazon ECDSA 384 Root EU M1
- Serial: -
- SHA-256: 46D1B2F46F959410BD0201702CB33077A9C34F5CB23F976CDD8D328989B04B27
- SPKI SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
- Validity: 2025-10-01 to 2033-09-29
- Key: unknown
- Signature Algorithm: -

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-01.r1.ica.amznts.eu/e3s02/1a27cd28-0861-42c2-8e6c-888da5488d55.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: -
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
SHA256 Fingerprint: 46D1B2F46F959410BD0201702CB33077A9C34F5CB23F976CDD8D328989B04B27
SPKI SHA256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
```

#### Extensions

- Basic Constraints: {"present":false,"critical":false,"ca":false,"path_len":null}
- Key Usage: -
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- is_ca

### Amazon ECDSA 384 M01

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 M01
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 077312757EF4C3660F08AF2403D3E55435D40B
- SHA-256: DFE35C740CF41C0B053E2202EA5AFC2F021F70BF90B26BC861FE1D9A0BFC4F1E
- SPKI SHA-256: 44CDF2E6D727D6810E74477E233799630C6BF8588C17A0C06F2773F144BD2070
- Validity: 2022-08-23 to 2030-08-23
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d960de8d-58e1-49cd-b021-b81d840df468, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2089114f-2403-404e-9861-bcfc60426e0f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf97e8d2-eb5b-4702-9635-a1e8fffb0903, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9260ceb-c627-473c-b934-7a2da4f8930b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b6f87753-9559-4ee9-a79a-517d669b7a9a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=69e3c555-0da9-4b06-a1c1-64756cddb5ac
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.e3m01.amazontrust.com/e3m01.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:73:12:75:7e:f4:c3:66:0f:08:af:24:03:d3:e5:54:35:d4:0b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Aug 23 22:35:05 2022 GMT
            Not After : Aug 23 22:35:05 2030 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 M01
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                03:E4:A4:04:8E:05:7F:9A:12:97:84:04:FF:11:77:30:8C:BA:2A:A7
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: DFE35C740CF41C0B053E2202EA5AFC2F021F70BF90B26BC861FE1D9A0BFC4F1E
    SPKI SHA256: 44CDF2E6D727D6810E74477E233799630C6BF8588C17A0C06F2773F144BD2070
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 M02

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 M02
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 0773127DFAA6B9E2B95538AA76DDE4307F17C4
- SHA-256: A7D15E62C78825919FB59BDE58EFCFB0225B4107DFC60026885420185DC69B63
- SPKI SHA-256: D18CF2F7C206D283C02765330F6E77364B304091FB5C5617220096A69C153DB4
- Validity: 2022-08-23 to 2030-08-23
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d960de8d-58e1-49cd-b021-b81d840df468, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2089114f-2403-404e-9861-bcfc60426e0f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf97e8d2-eb5b-4702-9635-a1e8fffb0903, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9260ceb-c627-473c-b934-7a2da4f8930b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b6f87753-9559-4ee9-a79a-517d669b7a9a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=69e3c555-0da9-4b06-a1c1-64756cddb5ac
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.e3m02.amazontrust.com/e3m02.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:73:12:7d:fa:a6:b9:e2:b9:55:38:aa:76:dd:e4:30:7f:17:c4
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Aug 23 22:36:58 2022 GMT
            Not After : Aug 23 22:36:58 2030 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 M02
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                A6:D9:AB:3B:87:99:33:FF:E8:68:F8:8B:61:83:6C:D0:B2:BA:AF:BD
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: A7D15E62C78825919FB59BDE58EFCFB0225B4107DFC60026885420185DC69B63
    SPKI SHA256: D18CF2F7C206D283C02765330F6E77364B304091FB5C5617220096A69C153DB4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 M03

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 M03
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 0773128034D8CF08CD09FA7AC26FD3DABC9984
- SHA-256: F40DA455BE136E0DB31A116FFD3C3002B1EBBC591558493FE630A9C8C9AFAD70
- SPKI SHA-256: BAC670DAA4C5278A9CAFD339AF31226DA0B8E646B53158775131B526760E2D45
- Validity: 2022-08-23 to 2030-08-23
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d960de8d-58e1-49cd-b021-b81d840df468, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2089114f-2403-404e-9861-bcfc60426e0f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf97e8d2-eb5b-4702-9635-a1e8fffb0903, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9260ceb-c627-473c-b934-7a2da4f8930b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b6f87753-9559-4ee9-a79a-517d669b7a9a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=69e3c555-0da9-4b06-a1c1-64756cddb5ac
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.e3m03.amazontrust.com/e3m03.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:73:12:80:34:d8:cf:08:cd:09:fa:7a:c2:6f:d3:da:bc:99:84
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Aug 23 22:37:27 2022 GMT
            Not After : Aug 23 22:37:27 2030 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 M03
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                A8:E5:E3:A5:FA:49:28:BE:C6:7D:FE:22:DC:82:FA:0C:2D:86:47:18
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F40DA455BE136E0DB31A116FFD3C3002B1EBBC591558493FE630A9C8C9AFAD70
    SPKI SHA256: BAC670DAA4C5278A9CAFD339AF31226DA0B8E646B53158775131B526760E2D45
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 M04

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 M04
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 07731282B8D0EB83B7B3740058DAB497D0BE74
- SHA-256: 47FD11AD552AB264D7F272770D3B5590AAE145412F4AD6081BDC485298D8E000
- SPKI SHA-256: A3F744136445EC713260460603412964716FEEB8D99D8494EBFE7BE15B018956
- Validity: 2022-08-23 to 2030-08-23
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d960de8d-58e1-49cd-b021-b81d840df468, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2089114f-2403-404e-9861-bcfc60426e0f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf97e8d2-eb5b-4702-9635-a1e8fffb0903, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9260ceb-c627-473c-b934-7a2da4f8930b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b6f87753-9559-4ee9-a79a-517d669b7a9a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=69e3c555-0da9-4b06-a1c1-64756cddb5ac
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.e3m04.amazontrust.com/e3m04.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:73:12:82:b8:d0:eb:83:b7:b3:74:00:58:da:b4:97:d0:be:74
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Aug 23 22:38:01 2022 GMT
            Not After : Aug 23 22:38:01 2030 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 M04
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                52:F0:D2:50:80:3C:D4:19:11:C8:83:6F:0E:02:BE:A8:4A:17:4D:C7
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 47FD11AD552AB264D7F272770D3B5590AAE145412F4AD6081BDC485298D8E000
    SPKI SHA256: A3F744136445EC713260460603412964716FEEB8D99D8494EBFE7BE15B018956
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 M05

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 M05
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 07C94234B1B9C67264A30B3F7622A0FDC9C701
- SHA-256: 36FDD1CDE845411BACF3C09E1CA09546DDC5DEA40332DE411AE56EEA349BAEBE
- SPKI SHA-256: D4355548E497AB4C247A0975FC6F6A22CC65C88D53467D0A000FA5BFC95F3B2D
- Validity: 2025-01-13 to 2033-01-13
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-01.r1.ica.amazontrust.com/crl/056676c5-7bcb-4bf6-92a2-d4495db364c4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:c9:42:34:b1:b9:c6:72:64:a3:0b:3f:76:22:a0:fd:c9:c7:01
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jan 13 23:56:53 2025 GMT
            Not After : Jan 13 23:56:53 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 M05
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                3A:81:65:15:79:16:8D:69:9D:29:B8:9F:85:37:2B:90:2C:11:6F:D7
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 36FDD1CDE845411BACF3C09E1CA09546DDC5DEA40332DE411AE56EEA349BAEBE
    SPKI SHA256: D4355548E497AB4C247A0975FC6F6A22CC65C88D53467D0A000FA5BFC95F3B2D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 M06

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 M06
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 07C94234B1BBFCF8EEC78641D8B8D2953A26CA
- SHA-256: 4F2D3225BA9E26817DFA325A4FB3397FDE34DE62C41D846CE05D815A10276C3B
- SPKI SHA-256: 85DE0208B443F9F869ECA58C48FE7E45F1D5494FEC6B7EE369C7736DD5B04BEB
- Validity: 2025-01-13 to 2033-01-13
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-01.r1.ica.amazontrust.com/crl/5ea4b76f-ee4c-4ea6-8a89-a46395f46679.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:c9:42:34:b1:bb:fc:f8:ee:c7:86:41:d8:b8:d2:95:3a:26:ca
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jan 13 23:57:19 2025 GMT
            Not After : Jan 13 23:57:19 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 M06
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                42:2A:76:99:9E:18:A5:2A:FA:14:CA:8C:31:B0:93:0C:F4:A1:0E:5F
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4F2D3225BA9E26817DFA325A4FB3397FDE34DE62C41D846CE05D815A10276C3B
    SPKI SHA256: 85DE0208B443F9F869ECA58C48FE7E45F1D5494FEC6B7EE369C7736DD5B04BEB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 Root EU M1

- Subject: countryName=DE, organizationName=Amazon, commonName=Amazon ECDSA 384 Root EU M1
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 62CAF8895DCC251E95FA971E79E3D59C56F5E380
- SHA-256: C5DF074E1C3A2EAEC742930BEDA6C1A429DB293F96A8F1DB3B1436D772B7C483
- SPKI SHA-256: 798FE10957E8C5A0874201CAF09D5EF4B2E2412C47BF991949566CB542D3AF3F
- Validity: 2025-09-17 to 2033-09-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://eue3m1.crl.root.amznts.eu/eue3m1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            62:ca:f8:89:5d:cc:25:1e:95:fa:97:1e:79:e3:d5:9c:56:f5:e3:80
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Sep 17 21:38:23 2025 GMT
            Not After : Sep 15 21:38:23 2033 GMT
        Subject: C = DE, O = Amazon, CN = Amazon ECDSA 384 Root EU M1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                B1:BB:47:20:39:9A:7D:80:17:1D:A6:05:5C:18:67:0C:1B:54:A2:A8
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C5DF074E1C3A2EAEC742930BEDA6C1A429DB293F96A8F1DB3B1436D772B7C483
    SPKI SHA256: 798FE10957E8C5A0874201CAF09D5EF4B2E2412C47BF991949566CB542D3AF3F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S00

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S00
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 07D683B67F1B20F585BA76B69F53668414C1E5
- SHA-256: 93EC4E9F741860919274887DE4883FA45646CDA8E4F2D81210FA432BB73ACE8E
- SPKI SHA-256: D593C63CB249989EAF8B0A216452024C800C5934F6647AB18CAF784EB4C49704
- Validity: 2025-05-28 to 2033-05-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:d6:83:b6:7f:1b:20:f5:85:ba:76:b6:9f:53:66:84:14:c1:e5
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: May 28 17:28:56 2025 GMT
            Not After : May 28 17:28:56 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S00
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                45:80:53:33:66:42:3F:08:04:57:FC:26:42:CF:F1:B0:34:61:BD:FE
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 93EC4E9F741860919274887DE4883FA45646CDA8E4F2D81210FA432BB73ACE8E
    SPKI SHA256: D593C63CB249989EAF8B0A216452024C800C5934F6647AB18CAF784EB4C49704
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S01

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S01
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 07D683B67F1C7DCDAFE6F70123930C89112609
- SHA-256: 8D35A11CA3AF4E072045779287D630C4F6D9F27183F7C3A42937181B41A5BF3B
- SPKI SHA-256: E650E2E91EE664D3BE646DA173C8851393350AA3042D8C2E3A4EA65389FEBFCF
- Validity: 2025-05-28 to 2033-05-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:d6:83:b6:7f:1c:7d:cd:af:e6:f7:01:23:93:0c:89:11:26:09
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: May 28 17:28:57 2025 GMT
            Not After : May 28 17:28:57 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S01
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                8E:FC:88:FB:BA:E1:49:2B:55:85:D6:A8:A6:CA:9C:00:62:1C:6D:7A
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 8D35A11CA3AF4E072045779287D630C4F6D9F27183F7C3A42937181B41A5BF3B
    SPKI SHA256: E650E2E91EE664D3BE646DA173C8851393350AA3042D8C2E3A4EA65389FEBFCF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S02

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S02
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 07D683B67F1D1263F8418A16AC34AF20FBE236
- SHA-256: C0327B482184F0C4205DF9297525AAD2A9F0EFF6BDA7DDF66045BAFDEFD4130E
- SPKI SHA-256: 3A08EBF4F5472AF210A080C59F8513AE887B8E10FA5261376D92E8D1BDBEC228
- Validity: 2025-05-28 to 2033-05-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:d6:83:b6:7f:1d:12:63:f8:41:8a:16:ac:34:af:20:fb:e2:36
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: May 28 17:28:57 2025 GMT
            Not After : May 28 17:28:57 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S02
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                90:6D:39:E9:C2:0F:E2:7C:D7:AB:C1:4C:9F:10:E0:D9:93:32:84:A3
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C0327B482184F0C4205DF9297525AAD2A9F0EFF6BDA7DDF66045BAFDEFD4130E
    SPKI SHA256: 3A08EBF4F5472AF210A080C59F8513AE887B8E10FA5261376D92E8D1BDBEC228
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S03

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S03
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 07D683B67F1D937BC0C9FEF461B78604C721C5
- SHA-256: 835C93CDA003A8A86C3F4B6BE94950F77545EED8D530EB6DC99140C5149E7FDD
- SPKI SHA-256: 6DAD74032D6CB6D8C69D71A50624356432DC22E825B9338C9E8AABEC8685FECB
- Validity: 2025-05-28 to 2033-05-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:d6:83:b6:7f:1d:93:7b:c0:c9:fe:f4:61:b7:86:04:c7:21:c5
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: May 28 17:28:58 2025 GMT
            Not After : May 28 17:28:58 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S03
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                5B:9C:87:B2:16:5B:A6:85:70:0D:20:7C:74:10:F2:22:C3:24:8C:22
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 835C93CDA003A8A86C3F4B6BE94950F77545EED8D530EB6DC99140C5149E7FDD
    SPKI SHA256: 6DAD74032D6CB6D8C69D71A50624356432DC22E825B9338C9E8AABEC8685FECB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S04

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S04
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 07D683B67F1E0A44ABD281137BEFB32A95A268
- SHA-256: 28580C4094EF43998D367AAD6D7A71AD3D93DB4C8A4CE21B3FB992AE9EA7F8F3
- SPKI SHA-256: 80FF251CE9D865ED449876B85C043CDB78F9E7CE02A81E9EE4A7C9BC88228E05
- Validity: 2025-05-28 to 2033-05-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:d6:83:b6:7f:1e:0a:44:ab:d2:81:13:7b:ef:b3:2a:95:a2:68
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: May 28 17:28:58 2025 GMT
            Not After : May 28 17:28:58 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S04
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                99:73:20:CA:A4:F1:68:3A:15:46:22:7C:14:99:4D:18:E0:BF:32:DE
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 28580C4094EF43998D367AAD6D7A71AD3D93DB4C8A4CE21B3FB992AE9EA7F8F3
    SPKI SHA256: 80FF251CE9D865ED449876B85C043CDB78F9E7CE02A81E9EE4A7C9BC88228E05
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S05

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S05
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 07D683B67F1E79835B08565446384FE336B6FF
- SHA-256: 684560D8149E60A28EF6A9EB08774FAD0EA49285D278E34AEDEEF291F8DC8F85
- SPKI SHA-256: C1BA8381552D1C35CE359F7E1C21D761E95E944628F7C237235D1A46AFBEB5BA
- Validity: 2025-05-28 to 2033-05-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:d6:83:b6:7f:1e:79:83:5b:08:56:54:46:38:4f:e3:36:b6:ff
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: May 28 17:28:59 2025 GMT
            Not After : May 28 17:28:59 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S05
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                01:5B:81:46:89:EF:B5:50:06:E2:8E:D2:2D:5D:3F:F0:9B:FE:26:F8
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 684560D8149E60A28EF6A9EB08774FAD0EA49285D278E34AEDEEF291F8DC8F85
    SPKI SHA256: C1BA8381552D1C35CE359F7E1C21D761E95E944628F7C237235D1A46AFBEB5BA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S06

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S06
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 35EDA8E32C6748B1708E29CE54881D77E9F46BBE
- SHA-256: DA04D90CE79D2EF660296385DE63F1ECEA9DFF9AACC2FDA9185D102B039B1B08
- SPKI SHA-256: FE8C9A1E80CE916AF04E6B7F90530F8F900A550BDFF4B86AF4F63D969DFFC172
- Validity: 2026-04-22 to 2029-04-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r1001.amazontrust.com/e3s06/f1e23d2e-95ad-4d82-ab8f-ef7aa539fbf9.crl, http://crl.r1001.amazontrust.com/e3s06/5GgLaumwNMA.crl, http://crl.r1001.amazontrust.com/e3s06/1VIzIcbzNo1.crl, http://crl.r1001.amazontrust.com/e3s06/D71MLyMUhji.crl, http://crl.r1001.amazontrust.com/e3s06/F7jy6TN8Asm.crl, http://crl.r1001.amazontrust.com/e3s06/A9djO03pGeu.crl, http://crl.r1001.amazontrust.com/e3s06/3KeWnYLSLi4.crl, http://crl.r1001.amazontrust.com/e3s06/EtGs3nWgLF5.crl, http://crl.r1001.amazontrust.com/e3s06/9NutR7lO4Ff.crl, http://crl.r1001.amazontrust.com/e3s06/92x7cijorfd.crl, http://crl.r1001.amazontrust.com/e3s06/KKBvdPAhvCt.crl, http://crl.r1001.amazontrust.com/e3s06/DNEByQkNLsN.crl, http://crl.r1001.amazontrust.com/e3s06/7RvnM0yFhHE.crl, http://crl.r1001.amazontrust.com/e3s06/IyzBnoWRboh.crl, http://crl.r1001.amazontrust.com/e3s06/BspWEEAshKc.crl, http://crl.r1001.amazontrust.com/e3s06/4BpgkMNP0JN.crl, http://crl.r1001.amazontrust.com/e3s06/JtrXfdYOxg9.crl, http://crl.r1001.amazontrust.com/e3s06/KFwqRQ2ihIT.crl, http://crl.r1001.amazontrust.com/e3s06/EUDyiJrJCOh.crl, http://crl.r1001.amazontrust.com/e3s06/7wtum4znKD0.crl, http://crl.r1001.amazontrust.com/e3s06/9g1XdHMfZor.crl, http://crl.r1001.amazontrust.com/e3s06/DFZkS3qa7G9.crl, http://crl.r1001.amazontrust.com/e3s06/8Jl7uOYiCSr.crl, http://crl.r1001.amazontrust.com/e3s06/IxgMioGu2wQ.crl, http://crl.r1001.amazontrust.com/e3s06/2zyGauHqcn9.crl, http://crl.r1001.amazontrust.com/e3s06/7cNxhxUWGpS.crl, http://crl.r1001.amazontrust.com/e3s06/HG6opvqvsOR.crl, http://crl.r1001.amazontrust.com/e3s06/Je8xRB5ZAb.crl, http://crl.r1001.amazontrust.com/e3s06/IYaOG2OMyXX.crl, http://crl.r1001.amazontrust.com/e3s06/JeMgabgDzuE.crl, http://crl.r1001.amazontrust.com/e3s06/DR2c0ujNzSG.crl, http://crl.r1001.amazontrust.com/e3s06/DqtYNMyYFB7.crl, http://crl.r1001.amazontrust.com/e3s06/FVDZv1Io7SU.crl, http://crl.r1001.amazontrust.com/e3s06/KWKuooUiEJf.crl, http://crl.r1001.amazontrust.com/e3s06/6qYYyYokguv.crl, http://crl.r1001.amazontrust.com/e3s06/5VzIsjSoiB3.crl, http://crl.r1001.amazontrust.com/e3s06/1W1uHwTQX9Q.crl, http://crl.r1001.amazontrust.com/e3s06/6WB8ZaYgyD2.crl, http://crl.r1001.amazontrust.com/e3s06/4FNMF4rvtJn.crl, http://crl.r1001.amazontrust.com/e3s06/Bfcyn4mCzFA.crl, http://crl.r1001.amazontrust.com/e3s06/2NaczRJeh25.crl, http://crl.r1001.amazontrust.com/e3s06/B6grCxhCMns.crl, http://crl.r1001.amazontrust.com/e3s06/DaffNS7iDN2.crl, http://crl.r1001.amazontrust.com/e3s06/2Ddo5aPmRoG.crl, http://crl.r1001.amazontrust.com/e3s06/IshrywGmZzp.crl, http://crl.r1001.amazontrust.com/e3s06/I7lN7j9Fhyv.crl, http://crl.r1001.amazontrust.com/e3s06/9fpoo1K8LsT.crl, http://crl.r1001.amazontrust.com/e3s06/Bq35B0ZxOiZ.crl, http://crl.r1001.amazontrust.com/e3s06/Iz3ndqMUW2b.crl, http://crl.r1001.amazontrust.com/e3s06/IRqqc08fqhz.crl, http://crl.r1001.amazontrust.com/e3s06/6yAZjUC8w16.crl, http://crl.r1001.amazontrust.com/e3s06/99QYzklmpNu.crl, http://crl.r1001.amazontrust.com/e3s06/BCiNpLzQDRq.crl, http://crl.r1001.amazontrust.com/e3s06/7xHbGPzeMcF.crl, http://crl.r1001.amazontrust.com/e3s06/BcBny1djnvq.crl, http://crl.r1001.amazontrust.com/e3s06/2EZzl0cvjhZ.crl, http://crl.r1001.amazontrust.com/e3s06/34pPX2fapCB.crl, http://crl.r1001.amazontrust.com/e3s06/HKLDBB1DWvZ.crl, http://crl.r1001.amazontrust.com/e3s06/KPQH8DXhrWp.crl, http://crl.r1001.amazontrust.com/e3s06/7ifPaFYdxDQ.crl, http://crl.r1001.amazontrust.com/e3s06/8zbLQaiYVQ4.crl, http://crl.r1001.amazontrust.com/e3s06/GwUbmrehEJr.crl, http://crl.r1001.amazontrust.com/e3s06/61LzPNRf7jy.crl, http://crl.r1001.amazontrust.com/e3s06/76CILKALZJH.crl, http://crl.r1001.amazontrust.com/e3s06/39CDU7FsCUe.crl, http://crl.r1001.amazontrust.com/e3s06/8mnH815qQw6.crl, http://crl.r1001.amazontrust.com/e3s06/HmuK4oF1cEV.crl, http://crl.r1001.amazontrust.com/e3s06/CIdMFaGGnsd.crl, http://crl.r1001.amazontrust.com/e3s06/BXLhNR87hZq.crl, http://crl.r1001.amazontrust.com/e3s06/2x2PoDJoHby.crl, http://crl.r1001.amazontrust.com/e3s06/5czgGZg2aqM.crl, http://crl.r1001.amazontrust.com/e3s06/KrWAf9kYt7E.crl, http://crl.r1001.amazontrust.com/e3s06/CoiLLaogLl.crl, http://crl.r1001.amazontrust.com/e3s06/CX6mqUGMJhi.crl, http://crl.r1001.amazontrust.com/e3s06/J4Vx0QDEJMH.crl, http://crl.r1001.amazontrust.com/e3s06/L19NhMgPdmP.crl, http://crl.r1001.amazontrust.com/e3s06/8wLem0SEcJw.crl, http://crl.r1001.amazontrust.com/e3s06/Hf3BhTHXfeH.crl, http://crl.r1001.amazontrust.com/e3s06/21F4yEw9Uhd.crl, http://crl.r1001.amazontrust.com/e3s06/63iWnSa5wmS.crl, http://crl.r1001.amazontrust.com/e3s06/2n8w5WJq1cs.crl, http://crl.r1001.amazontrust.com/e3s06/LoB5QTIeI7j.crl, http://crl.r1001.amazontrust.com/e3s06/95vFZ1ov82O.crl, http://crl.r1001.amazontrust.com/e3s06/K8Qwdaj66N0.crl, http://crl.r1001.amazontrust.com/e3s06/25DoqPg4tzS.crl, http://crl.r1001.amazontrust.com/e3s06/C2Gos7eh5UX.crl, http://crl.r1001.amazontrust.com/e3s06/6OYOYLe5rXS.crl, http://crl.r1001.amazontrust.com/e3s06/JxtuazwM0M3.crl, http://crl.r1001.amazontrust.com/e3s06/GgM2gJGHx1N.crl, http://crl.r1001.amazontrust.com/e3s06/7K0Eq3HGalN.crl, http://crl.r1001.amazontrust.com/e3s06/4NQYW4uLnjf.crl, http://crl.r1001.amazontrust.com/e3s06/LAJUdGcjD3o.crl, http://crl.r1001.amazontrust.com/e3s06/HLWVytOP0eW.crl, http://crl.r1001.amazontrust.com/e3s06/JOOuVNTUnDI.crl, http://crl.r1001.amazontrust.com/e3s06/6wnNzeLySxa.crl, http://crl.r1001.amazontrust.com/e3s06/58hU0xmp5OI.crl, http://crl.r1001.amazontrust.com/e3s06/FKF8WTaY1lI.crl, http://crl.r1001.amazontrust.com/e3s06/G4PHt0orMUu.crl, http://crl.r1001.amazontrust.com/e3s06/DBbysR1DF62.crl, http://crl.r1001.amazontrust.com/e3s06/EaI0hWzcIp6.crl, http://crl.r1001.amazontrust.com/e3s06/7QwFt9RaK12.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            35:ed:a8:e3:2c:67:48:b1:70:8e:29:ce:54:88:1d:77:e9:f4:6b:be
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Apr 22 19:26:00 2026 GMT
            Not After : Apr 21 19:26:00 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S06
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                D0:0E:B7:E8:E9:37:A9:A8:92:C7:6B:24:09:02:81:9D:BF:FF:89:B8
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: DA04D90CE79D2EF660296385DE63F1ECEA9DFF9AACC2FDA9185D102B039B1B08
    SPKI SHA256: FE8C9A1E80CE916AF04E6B7F90530F8F900A550BDFF4B86AF4F63D969DFFC172
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S07

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S07
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 726905903B1E6B36AC2006A45B1A86D4E4D2A9DF
- SHA-256: 31628648F576AEFB32D061FCDCEEF744B3D6E58D13EF5F006B50CE4FBF48766F
- SPKI SHA-256: DBB04860D1ED059AA41089732DFCEA09236882CA1AADF23ADA1CA57A0F75684A
- Validity: 2026-04-22 to 2029-04-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r1001.amazontrust.com/e3s07/dc96594f-9538-4628-b89e-28f66e90216f.crl, http://crl.r1001.amazontrust.com/e3s07/5NQNkuLLr4k.crl, http://crl.r1001.amazontrust.com/e3s07/LgakZ77qSXk.crl, http://crl.r1001.amazontrust.com/e3s07/BOlmuUpGEat.crl, http://crl.r1001.amazontrust.com/e3s07/HtIaRwYXVDg.crl, http://crl.r1001.amazontrust.com/e3s07/LAaM1DhpZiu.crl, http://crl.r1001.amazontrust.com/e3s07/7DXs8evFAK1.crl, http://crl.r1001.amazontrust.com/e3s07/AfznW1jamLq.crl, http://crl.r1001.amazontrust.com/e3s07/Bw7VMGr3JZY.crl, http://crl.r1001.amazontrust.com/e3s07/CxRMrvwftnE.crl, http://crl.r1001.amazontrust.com/e3s07/D3YQOTS5yJv.crl, http://crl.r1001.amazontrust.com/e3s07/Jq7qQ0yNvgf.crl, http://crl.r1001.amazontrust.com/e3s07/AkoSBkRH7IX.crl, http://crl.r1001.amazontrust.com/e3s07/1PlE3kKD3mc.crl, http://crl.r1001.amazontrust.com/e3s07/35Lc6pjBynI.crl, http://crl.r1001.amazontrust.com/e3s07/6OYj2mllOyX.crl, http://crl.r1001.amazontrust.com/e3s07/3DWKjlR6UTA.crl, http://crl.r1001.amazontrust.com/e3s07/FIDHfWXpvoW.crl, http://crl.r1001.amazontrust.com/e3s07/jeX7dJI0XB.crl, http://crl.r1001.amazontrust.com/e3s07/JPqa07m0Yx.crl, http://crl.r1001.amazontrust.com/e3s07/1gJegjrSbCa.crl, http://crl.r1001.amazontrust.com/e3s07/90toeeOOpjT.crl, http://crl.r1001.amazontrust.com/e3s07/9nYVhbCigij.crl, http://crl.r1001.amazontrust.com/e3s07/B2Wngmqcy6D.crl, http://crl.r1001.amazontrust.com/e3s07/Cz3tcOhzk7F.crl, http://crl.r1001.amazontrust.com/e3s07/GyTa0GrXOy3.crl, http://crl.r1001.amazontrust.com/e3s07/4BEltc22xWH.crl, http://crl.r1001.amazontrust.com/e3s07/AgfGLQKayKz.crl, http://crl.r1001.amazontrust.com/e3s07/KhaLn1OrNXc.crl, http://crl.r1001.amazontrust.com/e3s07/KklyHLJqiDh.crl, http://crl.r1001.amazontrust.com/e3s07/KmfdG2oD16O.crl, http://crl.r1001.amazontrust.com/e3s07/7BhMUcRiQxt.crl, http://crl.r1001.amazontrust.com/e3s07/sNy13LZ2G0.crl, http://crl.r1001.amazontrust.com/e3s07/HWUGXjvuhQq.crl, http://crl.r1001.amazontrust.com/e3s07/IkLWb5tkLoL.crl, http://crl.r1001.amazontrust.com/e3s07/KmH9H2teUkA.crl, http://crl.r1001.amazontrust.com/e3s07/EEpwupey3ci.crl, http://crl.r1001.amazontrust.com/e3s07/2eey6sRtl0P.crl, http://crl.r1001.amazontrust.com/e3s07/H7xgoftDkeG.crl, http://crl.r1001.amazontrust.com/e3s07/JhHNjtJm6oQ.crl, http://crl.r1001.amazontrust.com/e3s07/DTTHTGivlfi.crl, http://crl.r1001.amazontrust.com/e3s07/2rOsSQoj53T.crl, http://crl.r1001.amazontrust.com/e3s07/L2vD60A3gTH.crl, http://crl.r1001.amazontrust.com/e3s07/7oIDtUUXe0H.crl, http://crl.r1001.amazontrust.com/e3s07/IbWTz8SHdk1.crl, http://crl.r1001.amazontrust.com/e3s07/7AHv5Z6uIzv.crl, http://crl.r1001.amazontrust.com/e3s07/C31Ukx9AzRx.crl, http://crl.r1001.amazontrust.com/e3s07/2oz2U19Tyyh.crl, http://crl.r1001.amazontrust.com/e3s07/2ZfTM1OKJiI.crl, http://crl.r1001.amazontrust.com/e3s07/9Z6dO0ip3Sb.crl, http://crl.r1001.amazontrust.com/e3s07/71md8TChLPz.crl, http://crl.r1001.amazontrust.com/e3s07/Js7EeziI0w7.crl, http://crl.r1001.amazontrust.com/e3s07/63H2LiMWfnL.crl, http://crl.r1001.amazontrust.com/e3s07/EQj4YSNwa4m.crl, http://crl.r1001.amazontrust.com/e3s07/7mQFmRnoBV1.crl, http://crl.r1001.amazontrust.com/e3s07/K4wdyoiA6fG.crl, http://crl.r1001.amazontrust.com/e3s07/2ErnxdnB8rY.crl, http://crl.r1001.amazontrust.com/e3s07/GClIup2mBSp.crl, http://crl.r1001.amazontrust.com/e3s07/FgfrZysEGYs.crl, http://crl.r1001.amazontrust.com/e3s07/2buWAx93hww.crl, http://crl.r1001.amazontrust.com/e3s07/J7ni2Ttww7x.crl, http://crl.r1001.amazontrust.com/e3s07/2rzWYC5oFKB.crl, http://crl.r1001.amazontrust.com/e3s07/7k9Ryj1yty1.crl, http://crl.r1001.amazontrust.com/e3s07/8P8nH3cuqRU.crl, http://crl.r1001.amazontrust.com/e3s07/21xBpxgLtGt.crl, http://crl.r1001.amazontrust.com/e3s07/AreVtlXD4Pp.crl, http://crl.r1001.amazontrust.com/e3s07/ITzdFzLcqBc.crl, http://crl.r1001.amazontrust.com/e3s07/CaVPVFO4zWe.crl, http://crl.r1001.amazontrust.com/e3s07/3NZTuaz9aMq.crl, http://crl.r1001.amazontrust.com/e3s07/6FFjPcXXjRo.crl, http://crl.r1001.amazontrust.com/e3s07/IpIH1Ka7iIo.crl, http://crl.r1001.amazontrust.com/e3s07/JrS3UdMPkA1.crl, http://crl.r1001.amazontrust.com/e3s07/HLW5dQDA2Tg.crl, http://crl.r1001.amazontrust.com/e3s07/ERuv6n8UVmC.crl, http://crl.r1001.amazontrust.com/e3s07/KeklsR7Z5Qm.crl, http://crl.r1001.amazontrust.com/e3s07/CBkIPMgfueP.crl, http://crl.r1001.amazontrust.com/e3s07/KKGjGXTukPN.crl, http://crl.r1001.amazontrust.com/e3s07/012ryDlg29W.crl, http://crl.r1001.amazontrust.com/e3s07/AoLW1NM27cz.crl, http://crl.r1001.amazontrust.com/e3s07/I4uZeesafQk.crl, http://crl.r1001.amazontrust.com/e3s07/98JdmBF5Q6j.crl, http://crl.r1001.amazontrust.com/e3s07/1m9YocwhUuu.crl, http://crl.r1001.amazontrust.com/e3s07/JY4RNXryEf1.crl, http://crl.r1001.amazontrust.com/e3s07/HATL0rXPgag.crl, http://crl.r1001.amazontrust.com/e3s07/HJzTtuqsBt3.crl, http://crl.r1001.amazontrust.com/e3s07/5QLplsIyMoY.crl, http://crl.r1001.amazontrust.com/e3s07/1eufOacSdrl.crl, http://crl.r1001.amazontrust.com/e3s07/CuZq84HzYY.crl, http://crl.r1001.amazontrust.com/e3s07/KCtPoYzrYGk.crl, http://crl.r1001.amazontrust.com/e3s07/2CEQrUdudDq.crl, http://crl.r1001.amazontrust.com/e3s07/AvG23e2w2GW.crl, http://crl.r1001.amazontrust.com/e3s07/JxU0qBjiuJC.crl, http://crl.r1001.amazontrust.com/e3s07/JZfhD70UEyD.crl, http://crl.r1001.amazontrust.com/e3s07/53CbFWaIRHp.crl, http://crl.r1001.amazontrust.com/e3s07/2SlfNhSO51y.crl, http://crl.r1001.amazontrust.com/e3s07/4R9GKwtIqn7.crl, http://crl.r1001.amazontrust.com/e3s07/PsZqME1NP8.crl, http://crl.r1001.amazontrust.com/e3s07/4FbEBcTrmsZ.crl, http://crl.r1001.amazontrust.com/e3s07/7yg8Yk0999L.crl, http://crl.r1001.amazontrust.com/e3s07/Bw5RgLGQ7mB.crl, http://crl.r1001.amazontrust.com/e3s07/3MapRTpGfWK.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            72:69:05:90:3b:1e:6b:36:ac:20:06:a4:5b:1a:86:d4:e4:d2:a9:df
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Apr 22 19:26:06 2026 GMT
            Not After : Apr 21 19:26:06 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S07
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                27:27:15:5A:FE:F6:2C:E7:10:85:E2:FD:8D:84:D0:C2:5A:E0:15:B7
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 31628648F576AEFB32D061FCDCEEF744B3D6E58D13EF5F006B50CE4FBF48766F
    SPKI SHA256: DBB04860D1ED059AA41089732DFCEA09236882CA1AADF23ADA1CA57A0F75684A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S08

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S08
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 4BE19EDA9583B6FAC88E255C48DE9C984523EB03
- SHA-256: DF95591DC62E0E08074889ECAE517C332DDB689A003DDD92731D40A77ED6C038
- SPKI SHA-256: 9F3EC4ACE1AC2BAB6ACD2D180CA4468B4DCBFA482749046FB1789216B3E425C7
- Validity: 2026-04-22 to 2029-04-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r1001.amazontrust.com/e3s08/b1e836ab-ad10-4f5b-833d-79968f0fb745.crl, http://crl.r1001.amazontrust.com/e3s08/3llmylVRIuD.crl, http://crl.r1001.amazontrust.com/e3s08/Ff8c2zYMQoz.crl, http://crl.r1001.amazontrust.com/e3s08/5ZKco94tGij.crl, http://crl.r1001.amazontrust.com/e3s08/27ORajmxhkp.crl, http://crl.r1001.amazontrust.com/e3s08/9DkmpmUheLU.crl, http://crl.r1001.amazontrust.com/e3s08/ATm9biEgrsY.crl, http://crl.r1001.amazontrust.com/e3s08/IvBiODJYNoe.crl, http://crl.r1001.amazontrust.com/e3s08/3Jxe1koXboD.crl, http://crl.r1001.amazontrust.com/e3s08/Dcpj08ipaC4.crl, http://crl.r1001.amazontrust.com/e3s08/2q2R8TMV0EQ.crl, http://crl.r1001.amazontrust.com/e3s08/B0PQm4y35jf.crl, http://crl.r1001.amazontrust.com/e3s08/B29q6tG64NU.crl, http://crl.r1001.amazontrust.com/e3s08/EKTCGgXZqMF.crl, http://crl.r1001.amazontrust.com/e3s08/KiFlxuqNZPI.crl, http://crl.r1001.amazontrust.com/e3s08/L6GIV7YPU6Y.crl, http://crl.r1001.amazontrust.com/e3s08/LYmZb4sLzHB.crl, http://crl.r1001.amazontrust.com/e3s08/6iKW7ymNIMH.crl, http://crl.r1001.amazontrust.com/e3s08/HrdsspWHaCl.crl, http://crl.r1001.amazontrust.com/e3s08/5IcxxlnYmcG.crl, http://crl.r1001.amazontrust.com/e3s08/6TFcRQy67vW.crl, http://crl.r1001.amazontrust.com/e3s08/15VGHe5qmiG.crl, http://crl.r1001.amazontrust.com/e3s08/1Acyv5HkSFE.crl, http://crl.r1001.amazontrust.com/e3s08/5mQRxkePK0G.crl, http://crl.r1001.amazontrust.com/e3s08/8zc3s3wUVhG.crl, http://crl.r1001.amazontrust.com/e3s08/DPHqtuAL0AK.crl, http://crl.r1001.amazontrust.com/e3s08/B2ZqNStZ2rP.crl, http://crl.r1001.amazontrust.com/e3s08/DRvaPKDgFK3.crl, http://crl.r1001.amazontrust.com/e3s08/HmsPIkVpWpz.crl, http://crl.r1001.amazontrust.com/e3s08/KVEav3FhNPe.crl, http://crl.r1001.amazontrust.com/e3s08/HqUh8kRjwrc.crl, http://crl.r1001.amazontrust.com/e3s08/5afjJWUYFy1.crl, http://crl.r1001.amazontrust.com/e3s08/7lA9d0m4OOT.crl, http://crl.r1001.amazontrust.com/e3s08/9iidHszX8Qy.crl, http://crl.r1001.amazontrust.com/e3s08/9mTHAnioux8.crl, http://crl.r1001.amazontrust.com/e3s08/Ga2DEbzomvZ.crl, http://crl.r1001.amazontrust.com/e3s08/HqMOH2LRCwC.crl, http://crl.r1001.amazontrust.com/e3s08/KxV53FhD5uG.crl, http://crl.r1001.amazontrust.com/e3s08/1rEqUCJ06bJ.crl, http://crl.r1001.amazontrust.com/e3s08/IKmmWtqXiSd.crl, http://crl.r1001.amazontrust.com/e3s08/3wPdGTuL7lD.crl, http://crl.r1001.amazontrust.com/e3s08/8cssHyo0iXO.crl, http://crl.r1001.amazontrust.com/e3s08/9TDYmiHEQfm.crl, http://crl.r1001.amazontrust.com/e3s08/FcTdHzxARVN.crl, http://crl.r1001.amazontrust.com/e3s08/9nO4QKyWg1B.crl, http://crl.r1001.amazontrust.com/e3s08/CGCPPoeHmBC.crl, http://crl.r1001.amazontrust.com/e3s08/6mcgrFVPsBK.crl, http://crl.r1001.amazontrust.com/e3s08/LbzmiSyAPnK.crl, http://crl.r1001.amazontrust.com/e3s08/EoEFwDHAONA.crl, http://crl.r1001.amazontrust.com/e3s08/DJKaxydDOPP.crl, http://crl.r1001.amazontrust.com/e3s08/GRnEkxGDQkG.crl, http://crl.r1001.amazontrust.com/e3s08/G2BSKs5k6Il.crl, http://crl.r1001.amazontrust.com/e3s08/2kB0pgIhSVx.crl, http://crl.r1001.amazontrust.com/e3s08/3Pjb9Icw1Gn.crl, http://crl.r1001.amazontrust.com/e3s08/21WhPoLAFvw.crl, http://crl.r1001.amazontrust.com/e3s08/2nUSsxJ8ze0.crl, http://crl.r1001.amazontrust.com/e3s08/6fPCL8P4x6a.crl, http://crl.r1001.amazontrust.com/e3s08/BYHP1iJxnAu.crl, http://crl.r1001.amazontrust.com/e3s08/2OxXYfyJpJK.crl, http://crl.r1001.amazontrust.com/e3s08/87xWDf92Vd9.crl, http://crl.r1001.amazontrust.com/e3s08/LVh1yqWE0gT.crl, http://crl.r1001.amazontrust.com/e3s08/FXMOtd4Bn93.crl, http://crl.r1001.amazontrust.com/e3s08/GdgD57aCTeJ.crl, http://crl.r1001.amazontrust.com/e3s08/KK1hZiXMvMa.crl, http://crl.r1001.amazontrust.com/e3s08/HlHkMTRbLBo.crl, http://crl.r1001.amazontrust.com/e3s08/BYDisZxQ8nd.crl, http://crl.r1001.amazontrust.com/e3s08/3m5pJqAvE1J.crl, http://crl.r1001.amazontrust.com/e3s08/8crK9jokDPp.crl, http://crl.r1001.amazontrust.com/e3s08/H5QOzBOSK2E.crl, http://crl.r1001.amazontrust.com/e3s08/A7Kyan2r2pH.crl, http://crl.r1001.amazontrust.com/e3s08/AklWf40uFh2.crl, http://crl.r1001.amazontrust.com/e3s08/7UhJfpXO4QD.crl, http://crl.r1001.amazontrust.com/e3s08/Jyp0b58ZnsO.crl, http://crl.r1001.amazontrust.com/e3s08/FNNzOAB17No.crl, http://crl.r1001.amazontrust.com/e3s08/J2YdaaX9mpg.crl, http://crl.r1001.amazontrust.com/e3s08/LOpRVYx7jVH.crl, http://crl.r1001.amazontrust.com/e3s08/IBwTORWZT42.crl, http://crl.r1001.amazontrust.com/e3s08/5QgcfuSSwEM.crl, http://crl.r1001.amazontrust.com/e3s08/LKuHMyNAQ6M.crl, http://crl.r1001.amazontrust.com/e3s08/JiN3WywFd1N.crl, http://crl.r1001.amazontrust.com/e3s08/7JmmfDIG70Q.crl, http://crl.r1001.amazontrust.com/e3s08/JbXg3mtQVw9.crl, http://crl.r1001.amazontrust.com/e3s08/ImtYnUh5gcu.crl, http://crl.r1001.amazontrust.com/e3s08/LkF6iJKAnoH.crl, http://crl.r1001.amazontrust.com/e3s08/HGopieORSf2.crl, http://crl.r1001.amazontrust.com/e3s08/GRWsDNv5naP.crl, http://crl.r1001.amazontrust.com/e3s08/EZTk32tKztF.crl, http://crl.r1001.amazontrust.com/e3s08/Fietz8JLHR0.crl, http://crl.r1001.amazontrust.com/e3s08/E5etWAHFmZZ.crl, http://crl.r1001.amazontrust.com/e3s08/CXDJOLqi1Wj.crl, http://crl.r1001.amazontrust.com/e3s08/93SBC3Xx45l.crl, http://crl.r1001.amazontrust.com/e3s08/46SPld5slSN.crl, http://crl.r1001.amazontrust.com/e3s08/7KrBy959Ew3.crl, http://crl.r1001.amazontrust.com/e3s08/4xo4gZRHcqr.crl, http://crl.r1001.amazontrust.com/e3s08/Aj3WayYAlC9.crl, http://crl.r1001.amazontrust.com/e3s08/DQyWfHKtNcM.crl, http://crl.r1001.amazontrust.com/e3s08/DdLJiXb71ys.crl, http://crl.r1001.amazontrust.com/e3s08/8HmtEB3vsCA.crl, http://crl.r1001.amazontrust.com/e3s08/FNJi8DoUCQQ.crl, http://crl.r1001.amazontrust.com/e3s08/9pVOcA01Wq.crl, http://crl.r1001.amazontrust.com/e3s08/IaETk7gf4RO.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4b:e1:9e:da:95:83:b6:fa:c8:8e:25:5c:48:de:9c:98:45:23:eb:03
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Apr 22 19:26:11 2026 GMT
            Not After : Apr 21 19:26:11 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S08
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                6E:BE:EF:E1:D2:32:8D:5B:9C:BF:B6:71:04:1B:37:63:59:0A:B1:FA
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: DF95591DC62E0E08074889ECAE517C332DDB689A003DDD92731D40A77ED6C038
    SPKI SHA256: 9F3EC4ACE1AC2BAB6ACD2D180CA4468B4DCBFA482749046FB1789216B3E425C7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S09

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S09
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 76F507F39389B2B471C945DBC9A0EB7B41E1344E
- SHA-256: 59A35269A452111B61AAF9B3D6F10D00536E56FB70F1B0DB89BCE9B86963B1D6
- SPKI SHA-256: 18FA8A20F5B6EA6C86987C8B228ED5F9462E27BD2FF9BECB0D176EB22DDFA6D1
- Validity: 2026-04-22 to 2029-04-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r1001.amazontrust.com/e3s09/b8a4415a-ab38-4856-b3d5-0f88c35129e3.crl, http://crl.r1001.amazontrust.com/e3s09/BNnH7o7CBEA.crl, http://crl.r1001.amazontrust.com/e3s09/CnivBMTq1Im.crl, http://crl.r1001.amazontrust.com/e3s09/Cqfi7aHGvqx.crl, http://crl.r1001.amazontrust.com/e3s09/JB1T2GNxJU4.crl, http://crl.r1001.amazontrust.com/e3s09/COeJTbLXcbn.crl, http://crl.r1001.amazontrust.com/e3s09/NM6gRpoqDX.crl, http://crl.r1001.amazontrust.com/e3s09/1wNpD8RBy1w.crl, http://crl.r1001.amazontrust.com/e3s09/3cROvWhzxg5.crl, http://crl.r1001.amazontrust.com/e3s09/1d7SQlECFkF.crl, http://crl.r1001.amazontrust.com/e3s09/60uqDESQ3sJ.crl, http://crl.r1001.amazontrust.com/e3s09/FBEH4UVYc9a.crl, http://crl.r1001.amazontrust.com/e3s09/IEXzEGILcaB.crl, http://crl.r1001.amazontrust.com/e3s09/Gw1xTElOICw.crl, http://crl.r1001.amazontrust.com/e3s09/7oiyiO9rKid.crl, http://crl.r1001.amazontrust.com/e3s09/LPGwf8ZcWZ6.crl, http://crl.r1001.amazontrust.com/e3s09/07Tck1izQv.crl, http://crl.r1001.amazontrust.com/e3s09/B49dDshJ5eE.crl, http://crl.r1001.amazontrust.com/e3s09/CQ8bAryzVnI.crl, http://crl.r1001.amazontrust.com/e3s09/IK1nQrQ0wpc.crl, http://crl.r1001.amazontrust.com/e3s09/Dw3UhtPxRFz.crl, http://crl.r1001.amazontrust.com/e3s09/8YOJwI5cVea.crl, http://crl.r1001.amazontrust.com/e3s09/7GXJO5b2Yb2.crl, http://crl.r1001.amazontrust.com/e3s09/7PK9l6fd4Wz.crl, http://crl.r1001.amazontrust.com/e3s09/Ai7RMrH1eg5.crl, http://crl.r1001.amazontrust.com/e3s09/FrU2MY6ypcr.crl, http://crl.r1001.amazontrust.com/e3s09/HsxsvYAASsY.crl, http://crl.r1001.amazontrust.com/e3s09/Jyu3YzRjxr5.crl, http://crl.r1001.amazontrust.com/e3s09/Ih1JcWrkkBW.crl, http://crl.r1001.amazontrust.com/e3s09/6UD2CNqJDhP.crl, http://crl.r1001.amazontrust.com/e3s09/ErbeDxflYq.crl, http://crl.r1001.amazontrust.com/e3s09/BETOQkPDmjR.crl, http://crl.r1001.amazontrust.com/e3s09/5JsC3xmFAMI.crl, http://crl.r1001.amazontrust.com/e3s09/5Su0Ozow6Mm.crl, http://crl.r1001.amazontrust.com/e3s09/KgMMSEbVrSB.crl, http://crl.r1001.amazontrust.com/e3s09/Eo9R9FCjhAG.crl, http://crl.r1001.amazontrust.com/e3s09/56pcre2UJsf.crl, http://crl.r1001.amazontrust.com/e3s09/7jLWAOQagH1.crl, http://crl.r1001.amazontrust.com/e3s09/8uVc7isnKZG.crl, http://crl.r1001.amazontrust.com/e3s09/L9x5lW8hJql.crl, http://crl.r1001.amazontrust.com/e3s09/DgGeILUqNrr.crl, http://crl.r1001.amazontrust.com/e3s09/EcPPzGF9cAk.crl, http://crl.r1001.amazontrust.com/e3s09/BZBTs1XEvSL.crl, http://crl.r1001.amazontrust.com/e3s09/GN9sBnTOd36.crl, http://crl.r1001.amazontrust.com/e3s09/D5oydCSlQOA.crl, http://crl.r1001.amazontrust.com/e3s09/1IvtjeZvgfU.crl, http://crl.r1001.amazontrust.com/e3s09/A1JCm6VrVqV.crl, http://crl.r1001.amazontrust.com/e3s09/ATCq4aIt9Va.crl, http://crl.r1001.amazontrust.com/e3s09/E6T4WghDPFj.crl, http://crl.r1001.amazontrust.com/e3s09/AAgVh9Y5NVm.crl, http://crl.r1001.amazontrust.com/e3s09/Amw1xJaQMiH.crl, http://crl.r1001.amazontrust.com/e3s09/G9MFPvcdJmI.crl, http://crl.r1001.amazontrust.com/e3s09/KcIQw2akcYt.crl, http://crl.r1001.amazontrust.com/e3s09/Et8JomWNPfm.crl, http://crl.r1001.amazontrust.com/e3s09/HTKoEt8JcQh.crl, http://crl.r1001.amazontrust.com/e3s09/G0yhqoGBasr.crl, http://crl.r1001.amazontrust.com/e3s09/3j2N7Tuzzme.crl, http://crl.r1001.amazontrust.com/e3s09/Tq3u5uslw5.crl, http://crl.r1001.amazontrust.com/e3s09/3G2GKslTA5a.crl, http://crl.r1001.amazontrust.com/e3s09/8eiSYWnvv9K.crl, http://crl.r1001.amazontrust.com/e3s09/AEirMstJXy4.crl, http://crl.r1001.amazontrust.com/e3s09/EUYVJVgX97Y.crl, http://crl.r1001.amazontrust.com/e3s09/2KZ3EjxVksf.crl, http://crl.r1001.amazontrust.com/e3s09/DFYpiWJ5UFL.crl, http://crl.r1001.amazontrust.com/e3s09/D79nrgZ9W4F.crl, http://crl.r1001.amazontrust.com/e3s09/KchcfdTNsSH.crl, http://crl.r1001.amazontrust.com/e3s09/LleVUCLovjK.crl, http://crl.r1001.amazontrust.com/e3s09/2hQCCQbLwuQ.crl, http://crl.r1001.amazontrust.com/e3s09/KlWWyT2I6In.crl, http://crl.r1001.amazontrust.com/e3s09/4Tr3ojOJTU3.crl, http://crl.r1001.amazontrust.com/e3s09/5S2jClx5f1H.crl, http://crl.r1001.amazontrust.com/e3s09/Lin4DZOLfuB.crl, http://crl.r1001.amazontrust.com/e3s09/6MGuh4rpzZR.crl, http://crl.r1001.amazontrust.com/e3s09/9tCuVrC6IKj.crl, http://crl.r1001.amazontrust.com/e3s09/51X4vDRDj2L.crl, http://crl.r1001.amazontrust.com/e3s09/8F957fdLgCB.crl, http://crl.r1001.amazontrust.com/e3s09/1jz8ucfzzQx.crl, http://crl.r1001.amazontrust.com/e3s09/Jtsy2okbrzU.crl, http://crl.r1001.amazontrust.com/e3s09/1IxdQRIOXLs.crl, http://crl.r1001.amazontrust.com/e3s09/1EwRZQe3vy8.crl, http://crl.r1001.amazontrust.com/e3s09/59vsa0h5S5Z.crl, http://crl.r1001.amazontrust.com/e3s09/uKCjMPHkev.crl, http://crl.r1001.amazontrust.com/e3s09/IksBHLIcw30.crl, http://crl.r1001.amazontrust.com/e3s09/BqF9kjfGtQo.crl, http://crl.r1001.amazontrust.com/e3s09/8Wk0gHUxHFE.crl, http://crl.r1001.amazontrust.com/e3s09/AJlGs5sbEIW.crl, http://crl.r1001.amazontrust.com/e3s09/CGG0Y5jOsP0.crl, http://crl.r1001.amazontrust.com/e3s09/C2ZUNPmCyli.crl, http://crl.r1001.amazontrust.com/e3s09/KAUxlG5C86N.crl, http://crl.r1001.amazontrust.com/e3s09/97rOK6rXeHG.crl, http://crl.r1001.amazontrust.com/e3s09/Ex3H5WF91eF.crl, http://crl.r1001.amazontrust.com/e3s09/Ey9nhWy4U0t.crl, http://crl.r1001.amazontrust.com/e3s09/FMqc1mceYi3.crl, http://crl.r1001.amazontrust.com/e3s09/5yKLGnj6qi3.crl, http://crl.r1001.amazontrust.com/e3s09/4JALkBvMq4D.crl, http://crl.r1001.amazontrust.com/e3s09/25nVoAAQuQb.crl, http://crl.r1001.amazontrust.com/e3s09/4QFBlFd6ssP.crl, http://crl.r1001.amazontrust.com/e3s09/155TXFzEMlK.crl, http://crl.r1001.amazontrust.com/e3s09/HkCyPGq8eD5.crl, http://crl.r1001.amazontrust.com/e3s09/5Jf4s55k0Bd.crl, http://crl.r1001.amazontrust.com/e3s09/DoUKfUgdQkW.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:f5:07:f3:93:89:b2:b4:71:c9:45:db:c9:a0:eb:7b:41:e1:34:4e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Apr 22 19:26:16 2026 GMT
            Not After : Apr 21 19:26:16 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S09
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                45:4E:5A:DC:C5:63:9A:F4:E1:2D:37:1A:15:0E:C2:88:DF:68:AA:9C
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 59A35269A452111B61AAF9B3D6F10D00536E56FB70F1B0DB89BCE9B86963B1D6
    SPKI SHA256: 18FA8A20F5B6EA6C86987C8B228ED5F9462E27BD2FF9BECB0D176EB22DDFA6D1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S10

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S10
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 6ABED28B3BDB289225BD73D5ABAA276FF439F14A
- SHA-256: B4331422B7ACAB57FB1D709509F71D3B21B247271817483940DCE4700F18F83E
- SPKI SHA-256: CE655DC802BDF421597D26E0162807CFF0109D548F86D0827DB558A6CD0BD3D5
- Validity: 2026-04-22 to 2029-04-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r2001.amazontrust.com/e3s10/570a2ddc-e634-44f6-aca7-45d64e419dc3.crl, http://crl.r2001.amazontrust.com/e3s10/He5ZOY0hVVY.crl, http://crl.r2001.amazontrust.com/e3s10/HHY3efm0mrb.crl, http://crl.r2001.amazontrust.com/e3s10/FqGb3OnItlb.crl, http://crl.r2001.amazontrust.com/e3s10/2eS7iHeMNrn.crl, http://crl.r2001.amazontrust.com/e3s10/GEhBqrwP4lE.crl, http://crl.r2001.amazontrust.com/e3s10/HjxzfIanp23.crl, http://crl.r2001.amazontrust.com/e3s10/2m2B2ScKdL7.crl, http://crl.r2001.amazontrust.com/e3s10/3pRk6CVRT7n.crl, http://crl.r2001.amazontrust.com/e3s10/8d9bD01bSAc.crl, http://crl.r2001.amazontrust.com/e3s10/9zHjsjKQNCS.crl, http://crl.r2001.amazontrust.com/e3s10/BTdOFiZEpde.crl, http://crl.r2001.amazontrust.com/e3s10/CIc8OOZJlko.crl, http://crl.r2001.amazontrust.com/e3s10/2V2LGUJJMz7.crl, http://crl.r2001.amazontrust.com/e3s10/BYmiHkqTHMi.crl, http://crl.r2001.amazontrust.com/e3s10/I8ExytXObaz.crl, http://crl.r2001.amazontrust.com/e3s10/KZmgDisVHCJ.crl, http://crl.r2001.amazontrust.com/e3s10/60UTJIRbUHh.crl, http://crl.r2001.amazontrust.com/e3s10/1kH7tZ8aTT9.crl, http://crl.r2001.amazontrust.com/e3s10/3YWIJOwbtyt.crl, http://crl.r2001.amazontrust.com/e3s10/D5Wm7VAAIWY.crl, http://crl.r2001.amazontrust.com/e3s10/LHuLhu0ui2P.crl, http://crl.r2001.amazontrust.com/e3s10/LgD5WApqnFq.crl, http://crl.r2001.amazontrust.com/e3s10/4ezTGpl8nIF.crl, http://crl.r2001.amazontrust.com/e3s10/15AqigqEZst.crl, http://crl.r2001.amazontrust.com/e3s10/3FPkD0rEtPR.crl, http://crl.r2001.amazontrust.com/e3s10/A5cByRL6n21.crl, http://crl.r2001.amazontrust.com/e3s10/Dy3KGrtN3Lh.crl, http://crl.r2001.amazontrust.com/e3s10/GjXxOMA3Anp.crl, http://crl.r2001.amazontrust.com/e3s10/KnBGUgpkWqr.crl, http://crl.r2001.amazontrust.com/e3s10/8AWvktv41za.crl, http://crl.r2001.amazontrust.com/e3s10/L5DDTUq1sLD.crl, http://crl.r2001.amazontrust.com/e3s10/2pN3APo0FPL.crl, http://crl.r2001.amazontrust.com/e3s10/AOv6hfxRwK8.crl, http://crl.r2001.amazontrust.com/e3s10/DZgvff0chnI.crl, http://crl.r2001.amazontrust.com/e3s10/Hj8hPlSlFFR.crl, http://crl.r2001.amazontrust.com/e3s10/K9tYB5PGxQ4.crl, http://crl.r2001.amazontrust.com/e3s10/2JkKqlXo5a9.crl, http://crl.r2001.amazontrust.com/e3s10/8THWIueeftE.crl, http://crl.r2001.amazontrust.com/e3s10/L78mtsDJ1zs.crl, http://crl.r2001.amazontrust.com/e3s10/83pDDTfp6Ge.crl, http://crl.r2001.amazontrust.com/e3s10/69DNfwjGhHO.crl, http://crl.r2001.amazontrust.com/e3s10/6qWn0QrjagQ.crl, http://crl.r2001.amazontrust.com/e3s10/I5BecEuEPEm.crl, http://crl.r2001.amazontrust.com/e3s10/1dAV2Uj0a6j.crl, http://crl.r2001.amazontrust.com/e3s10/CJCsJia2kvf.crl, http://crl.r2001.amazontrust.com/e3s10/6k8XFcqBHiF.crl, http://crl.r2001.amazontrust.com/e3s10/5RqZ0yC80xG.crl, http://crl.r2001.amazontrust.com/e3s10/BRarJQ8KNA1.crl, http://crl.r2001.amazontrust.com/e3s10/KXqS26AMWdf.crl, http://crl.r2001.amazontrust.com/e3s10/DFK0Qdolbvi.crl, http://crl.r2001.amazontrust.com/e3s10/4WuKQeSwQWZ.crl, http://crl.r2001.amazontrust.com/e3s10/LHSTlzLGAlC.crl, http://crl.r2001.amazontrust.com/e3s10/2oCcuMavJ1m.crl, http://crl.r2001.amazontrust.com/e3s10/EWtdB78Xo7.crl, http://crl.r2001.amazontrust.com/e3s10/InSOzukFGsf.crl, http://crl.r2001.amazontrust.com/e3s10/7BVFutCkotU.crl, http://crl.r2001.amazontrust.com/e3s10/1owOr1ToXWz.crl, http://crl.r2001.amazontrust.com/e3s10/1kcPAauwzrM.crl, http://crl.r2001.amazontrust.com/e3s10/8XBztTXwaP9.crl, http://crl.r2001.amazontrust.com/e3s10/C7SBwfPyWk9.crl, http://crl.r2001.amazontrust.com/e3s10/E8toZH9ZZU2.crl, http://crl.r2001.amazontrust.com/e3s10/4epS2UpGJ7S.crl, http://crl.r2001.amazontrust.com/e3s10/IjJRtvM6fw.crl, http://crl.r2001.amazontrust.com/e3s10/EfzrW2OZddg.crl, http://crl.r2001.amazontrust.com/e3s10/7rL3dxaGRvR.crl, http://crl.r2001.amazontrust.com/e3s10/Jb9FoDer5ku.crl, http://crl.r2001.amazontrust.com/e3s10/26M1LiA4yXx.crl, http://crl.r2001.amazontrust.com/e3s10/EuDTfqmUBWu.crl, http://crl.r2001.amazontrust.com/e3s10/GBe7ScQJ1N7.crl, http://crl.r2001.amazontrust.com/e3s10/2HY2DoYHJn7.crl, http://crl.r2001.amazontrust.com/e3s10/LMOxiGFrGtT.crl, http://crl.r2001.amazontrust.com/e3s10/9G5BMHEpLdw.crl, http://crl.r2001.amazontrust.com/e3s10/Ju19IYSaOcP.crl, http://crl.r2001.amazontrust.com/e3s10/F5Z6vfmUHEe.crl, http://crl.r2001.amazontrust.com/e3s10/50lkdP5TGwW.crl, http://crl.r2001.amazontrust.com/e3s10/I9zIW0AIbND.crl, http://crl.r2001.amazontrust.com/e3s10/3wfmktnB26e.crl, http://crl.r2001.amazontrust.com/e3s10/9tMW1fwKZq4.crl, http://crl.r2001.amazontrust.com/e3s10/GiLUKcl4meK.crl, http://crl.r2001.amazontrust.com/e3s10/4NJxUBKkxfg.crl, http://crl.r2001.amazontrust.com/e3s10/A2t9EX3bFB8.crl, http://crl.r2001.amazontrust.com/e3s10/IDw3IXu9aph.crl, http://crl.r2001.amazontrust.com/e3s10/2Qoscipsptg.crl, http://crl.r2001.amazontrust.com/e3s10/9A2Ka2s6EoP.crl, http://crl.r2001.amazontrust.com/e3s10/I99Y3wDi104.crl, http://crl.r2001.amazontrust.com/e3s10/7t5ozhIzVhJ.crl, http://crl.r2001.amazontrust.com/e3s10/4YDe6PdPYGy.crl, http://crl.r2001.amazontrust.com/e3s10/1ExQcxO5aRL.crl, http://crl.r2001.amazontrust.com/e3s10/F2kADCxkeVm.crl, http://crl.r2001.amazontrust.com/e3s10/5RdoeX8IG97.crl, http://crl.r2001.amazontrust.com/e3s10/Bzohp6Wy47k.crl, http://crl.r2001.amazontrust.com/e3s10/Axr9hRwgpsG.crl, http://crl.r2001.amazontrust.com/e3s10/A8qjDwOmrWT.crl, http://crl.r2001.amazontrust.com/e3s10/Dl8xcK40itE.crl, http://crl.r2001.amazontrust.com/e3s10/2HECVPreozv.crl, http://crl.r2001.amazontrust.com/e3s10/3gk2FGlDqEd.crl, http://crl.r2001.amazontrust.com/e3s10/jFz0UBX82O.crl, http://crl.r2001.amazontrust.com/e3s10/1L2AWU6hb5k.crl, http://crl.r2001.amazontrust.com/e3s10/AsHd06CTlD3.crl, http://crl.r2001.amazontrust.com/e3s10/AuGychzfH3R.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6a:be:d2:8b:3b:db:28:92:25:bd:73:d5:ab:aa:27:6f:f4:39:f1:4a
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Apr 22 19:26:21 2026 GMT
            Not After : Apr 21 19:26:21 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S10
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                04:67:62:0E:6C:2F:B8:84:0E:89:3D:B3:F3:9F:2C:52:14:C6:53:00
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: B4331422B7ACAB57FB1D709509F71D3B21B247271817483940DCE4700F18F83E
    SPKI SHA256: CE655DC802BDF421597D26E0162807CFF0109D548F86D0827DB558A6CD0BD3D5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S11

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S11
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 7C0BC8C586E15CD2E21C6D6F9CCDA0747804B5C3
- SHA-256: 42BA4CDADDC71ED5E89ECAD163631A67CCCBFDEF156B316FFE68A47CBDF11DBC
- SPKI SHA-256: FDF433572901254473719C3EDEEBD72ED6AE0FA327F06CB379D365FA77177CCD
- Validity: 2026-04-22 to 2029-04-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r2001.amazontrust.com/e3s11/09de7e8e-0417-4b5c-bf76-345d2e42dd4d.crl, http://crl.r2001.amazontrust.com/e3s11/28LuxnxAChm.crl, http://crl.r2001.amazontrust.com/e3s11/C4MZf5qydhj.crl, http://crl.r2001.amazontrust.com/e3s11/6Ek27oXKXlZ.crl, http://crl.r2001.amazontrust.com/e3s11/DLgtKLwDID0.crl, http://crl.r2001.amazontrust.com/e3s11/6N7knMR6JqD.crl, http://crl.r2001.amazontrust.com/e3s11/DOVdASkhIan.crl, http://crl.r2001.amazontrust.com/e3s11/C9iUZ1YL6mi.crl, http://crl.r2001.amazontrust.com/e3s11/2lai50jg0Bg.crl, http://crl.r2001.amazontrust.com/e3s11/9XnnnYenxkv.crl, http://crl.r2001.amazontrust.com/e3s11/H8dVSI2Ij5V.crl, http://crl.r2001.amazontrust.com/e3s11/KuI8GrEepkN.crl, http://crl.r2001.amazontrust.com/e3s11/IVWhl9kodFz.crl, http://crl.r2001.amazontrust.com/e3s11/63cfif431Ac.crl, http://crl.r2001.amazontrust.com/e3s11/I90QWV3YLWT.crl, http://crl.r2001.amazontrust.com/e3s11/7C0rSbxEcoy.crl, http://crl.r2001.amazontrust.com/e3s11/HrYxKRgF0Ih.crl, http://crl.r2001.amazontrust.com/e3s11/AwczY15ZZLV.crl, http://crl.r2001.amazontrust.com/e3s11/DjvNkvNiH61.crl, http://crl.r2001.amazontrust.com/e3s11/4agTym0KjK4.crl, http://crl.r2001.amazontrust.com/e3s11/KFYceuevIED.crl, http://crl.r2001.amazontrust.com/e3s11/2DvYvvxtW9n.crl, http://crl.r2001.amazontrust.com/e3s11/1j8iUkXo6ne.crl, http://crl.r2001.amazontrust.com/e3s11/ENv9ICykxkK.crl, http://crl.r2001.amazontrust.com/e3s11/5FYEDXKOh1C.crl, http://crl.r2001.amazontrust.com/e3s11/6BOqzRIddAo.crl, http://crl.r2001.amazontrust.com/e3s11/CEGNBP2LSDZ.crl, http://crl.r2001.amazontrust.com/e3s11/Fv6suA4hcxj.crl, http://crl.r2001.amazontrust.com/e3s11/3qgwZKhv5xA.crl, http://crl.r2001.amazontrust.com/e3s11/3x7ILTZvnfN.crl, http://crl.r2001.amazontrust.com/e3s11/6kQKl43kyGq.crl, http://crl.r2001.amazontrust.com/e3s11/BFfyAVdmzHX.crl, http://crl.r2001.amazontrust.com/e3s11/BlvKjXKpfKa.crl, http://crl.r2001.amazontrust.com/e3s11/GEdUuFPuAIA.crl, http://crl.r2001.amazontrust.com/e3s11/HQBRJJqVLsM.crl, http://crl.r2001.amazontrust.com/e3s11/knXW8d1DIj.crl, http://crl.r2001.amazontrust.com/e3s11/51b4VVcJbHj.crl, http://crl.r2001.amazontrust.com/e3s11/H3gDbUAds4G.crl, http://crl.r2001.amazontrust.com/e3s11/4qpPLzvqu0u.crl, http://crl.r2001.amazontrust.com/e3s11/FIDpb3t5M4s.crl, http://crl.r2001.amazontrust.com/e3s11/Cf33nyOdAp5.crl, http://crl.r2001.amazontrust.com/e3s11/Hn429IVkgFA.crl, http://crl.r2001.amazontrust.com/e3s11/5hpbvuuyW12.crl, http://crl.r2001.amazontrust.com/e3s11/HmyUNBTQbmC.crl, http://crl.r2001.amazontrust.com/e3s11/A2PzIoomcTB.crl, http://crl.r2001.amazontrust.com/e3s11/Dur9dKEQt76.crl, http://crl.r2001.amazontrust.com/e3s11/EMwOcFcutor.crl, http://crl.r2001.amazontrust.com/e3s11/Ftw2gMv2IL.crl, http://crl.r2001.amazontrust.com/e3s11/H1OPhvzqK4w.crl, http://crl.r2001.amazontrust.com/e3s11/Jv5LI3MLct1.crl, http://crl.r2001.amazontrust.com/e3s11/GR6g1pgyoUm.crl, http://crl.r2001.amazontrust.com/e3s11/LHUrMhws0Qw.crl, http://crl.r2001.amazontrust.com/e3s11/4mF2L4gi1uh.crl, http://crl.r2001.amazontrust.com/e3s11/3ulAuCjgIoE.crl, http://crl.r2001.amazontrust.com/e3s11/I8zuWXiTu3w.crl, http://crl.r2001.amazontrust.com/e3s11/9RmAEskofZa.crl, http://crl.r2001.amazontrust.com/e3s11/CuuZ9YVfEGI.crl, http://crl.r2001.amazontrust.com/e3s11/IrZPkQBwMLg.crl, http://crl.r2001.amazontrust.com/e3s11/8jKLSKbrPJK.crl, http://crl.r2001.amazontrust.com/e3s11/HXbdjx6ZA8W.crl, http://crl.r2001.amazontrust.com/e3s11/Lvth5nZjfIm.crl, http://crl.r2001.amazontrust.com/e3s11/FStsHw1N5qR.crl, http://crl.r2001.amazontrust.com/e3s11/IOqfBrpB9X1.crl, http://crl.r2001.amazontrust.com/e3s11/DB2Pmi0QtSc.crl, http://crl.r2001.amazontrust.com/e3s11/ClJrLI3YmPV.crl, http://crl.r2001.amazontrust.com/e3s11/DTGO01WN47u.crl, http://crl.r2001.amazontrust.com/e3s11/23x6aj9rR8R.crl, http://crl.r2001.amazontrust.com/e3s11/BXH3eUxeXUp.crl, http://crl.r2001.amazontrust.com/e3s11/6lP6Z5WRluj.crl, http://crl.r2001.amazontrust.com/e3s11/1XSjwRHuaRl.crl, http://crl.r2001.amazontrust.com/e3s11/8pEQ6xiaeFT.crl, http://crl.r2001.amazontrust.com/e3s11/36wAz1qcIFb.crl, http://crl.r2001.amazontrust.com/e3s11/6ntbn21wcgP.crl, http://crl.r2001.amazontrust.com/e3s11/7KjLIUv9RmB.crl, http://crl.r2001.amazontrust.com/e3s11/B0TBu1w1PPk.crl, http://crl.r2001.amazontrust.com/e3s11/2lvlpIZFnxU.crl, http://crl.r2001.amazontrust.com/e3s11/K7DFOtAnVml.crl, http://crl.r2001.amazontrust.com/e3s11/Iq35JQMLVBp.crl, http://crl.r2001.amazontrust.com/e3s11/JfnB3vaiHyl.crl, http://crl.r2001.amazontrust.com/e3s11/CpTjVx7ogZP.crl, http://crl.r2001.amazontrust.com/e3s11/3eYDgyQglbK.crl, http://crl.r2001.amazontrust.com/e3s11/FD7d0CMMqOC.crl, http://crl.r2001.amazontrust.com/e3s11/CY5oQFCRh9T.crl, http://crl.r2001.amazontrust.com/e3s11/Wa5JobxAc3.crl, http://crl.r2001.amazontrust.com/e3s11/7qD18zPtd56.crl, http://crl.r2001.amazontrust.com/e3s11/F1lfN1TEk2i.crl, http://crl.r2001.amazontrust.com/e3s11/Hag23zPxzW3.crl, http://crl.r2001.amazontrust.com/e3s11/Aea4eVYxDQj.crl, http://crl.r2001.amazontrust.com/e3s11/9066LKU3Vwf.crl, http://crl.r2001.amazontrust.com/e3s11/ICS8r87xiVD.crl, http://crl.r2001.amazontrust.com/e3s11/4wq3retO8TV.crl, http://crl.r2001.amazontrust.com/e3s11/HwnyMO3y3zH.crl, http://crl.r2001.amazontrust.com/e3s11/3NLg15KaY2Z.crl, http://crl.r2001.amazontrust.com/e3s11/8DQG57uQvrG.crl, http://crl.r2001.amazontrust.com/e3s11/HE6fa0vBNqH.crl, http://crl.r2001.amazontrust.com/e3s11/EI3gQOcMcDq.crl, http://crl.r2001.amazontrust.com/e3s11/KchvSb0pRNG.crl, http://crl.r2001.amazontrust.com/e3s11/34H3sIceYZD.crl, http://crl.r2001.amazontrust.com/e3s11/DBvplzqDBLG.crl, http://crl.r2001.amazontrust.com/e3s11/9ugbfnZFjqG.crl, http://crl.r2001.amazontrust.com/e3s11/GBXQFePAjhG.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:0b:c8:c5:86:e1:5c:d2:e2:1c:6d:6f:9c:cd:a0:74:78:04:b5:c3
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Apr 22 19:26:26 2026 GMT
            Not After : Apr 21 19:26:26 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S11
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                6C:35:1C:6F:1C:A1:16:91:A4:45:6D:3A:B8:D3:41:BE:B1:D6:89:57
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 42BA4CDADDC71ED5E89ECAD163631A67CCCBFDEF156B316FFE68A47CBDF11DBC
    SPKI SHA256: FDF433572901254473719C3EDEEBD72ED6AE0FA327F06CB379D365FA77177CCD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S12

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S12
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 34A5B700601BE0401DCB2387D95BE4180978ECC7
- SHA-256: B52C4ABE186527B88AFFCCFD71830ECAF31155C1CD8369BB99D1338FCA081FEC
- SPKI SHA-256: 3A520822370917B114EDD1AADDFA9D1FB688E570767FE05470E61F1AF0F0CF62
- Validity: 2026-04-22 to 2029-04-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r2001.amazontrust.com/e3s12/c9923560-364c-450c-a0a8-8759d979bfcd.crl, http://crl.r2001.amazontrust.com/e3s12/4hfkc5ZN8QZ.crl, http://crl.r2001.amazontrust.com/e3s12/KwW12vIbymu.crl, http://crl.r2001.amazontrust.com/e3s12/ENBU0BRSsId.crl, http://crl.r2001.amazontrust.com/e3s12/9qTV0HDqLbT.crl, http://crl.r2001.amazontrust.com/e3s12/EsBBdry1GG9.crl, http://crl.r2001.amazontrust.com/e3s12/GhT7rw5vy2u.crl, http://crl.r2001.amazontrust.com/e3s12/DCTX2j5YCjh.crl, http://crl.r2001.amazontrust.com/e3s12/2eXISewmC3C.crl, http://crl.r2001.amazontrust.com/e3s12/E3CCIY19bDb.crl, http://crl.r2001.amazontrust.com/e3s12/7axPWtBToTn.crl, http://crl.r2001.amazontrust.com/e3s12/AhmpjLCbGMK.crl, http://crl.r2001.amazontrust.com/e3s12/8uVR4qMk8FR.crl, http://crl.r2001.amazontrust.com/e3s12/45UB2WCQsyY.crl, http://crl.r2001.amazontrust.com/e3s12/5qe8PCiLsN8.crl, http://crl.r2001.amazontrust.com/e3s12/DTxCJAIpLyJ.crl, http://crl.r2001.amazontrust.com/e3s12/1dsY2u7D1yb.crl, http://crl.r2001.amazontrust.com/e3s12/HXGk1nOXvsp.crl, http://crl.r2001.amazontrust.com/e3s12/6KQTDx4cjSr.crl, http://crl.r2001.amazontrust.com/e3s12/B1U2BXvUmqu.crl, http://crl.r2001.amazontrust.com/e3s12/HwxisRsxMqN.crl, http://crl.r2001.amazontrust.com/e3s12/4kjYs51Gz9C.crl, http://crl.r2001.amazontrust.com/e3s12/7sMy6IIO5i.crl, http://crl.r2001.amazontrust.com/e3s12/L0jPLevZsMm.crl, http://crl.r2001.amazontrust.com/e3s12/XTKTnAz5P7.crl, http://crl.r2001.amazontrust.com/e3s12/6RxktEJVoQc.crl, http://crl.r2001.amazontrust.com/e3s12/6q22vO0MFN2.crl, http://crl.r2001.amazontrust.com/e3s12/1CVVhVCKhsl.crl, http://crl.r2001.amazontrust.com/e3s12/bteMrJla9x.crl, http://crl.r2001.amazontrust.com/e3s12/D1WOc28hW4k.crl, http://crl.r2001.amazontrust.com/e3s12/81kfkvJUC3n.crl, http://crl.r2001.amazontrust.com/e3s12/9Do9H0OppFl.crl, http://crl.r2001.amazontrust.com/e3s12/24mN8HmmC4H.crl, http://crl.r2001.amazontrust.com/e3s12/4FCAEZbQshZ.crl, http://crl.r2001.amazontrust.com/e3s12/7h7HbaC4FfU.crl, http://crl.r2001.amazontrust.com/e3s12/LPPMO8IG22H.crl, http://crl.r2001.amazontrust.com/e3s12/7pHbuF2Qi4X.crl, http://crl.r2001.amazontrust.com/e3s12/ESOb2FMEKm0.crl, http://crl.r2001.amazontrust.com/e3s12/IcdZJZzieys.crl, http://crl.r2001.amazontrust.com/e3s12/HXEwV4DS9bM.crl, http://crl.r2001.amazontrust.com/e3s12/KG4QHmAKJI7.crl, http://crl.r2001.amazontrust.com/e3s12/LrGUAMSvI2S.crl, http://crl.r2001.amazontrust.com/e3s12/6FsreF7Vznz.crl, http://crl.r2001.amazontrust.com/e3s12/CFoBFsZ9zwC.crl, http://crl.r2001.amazontrust.com/e3s12/6GJpq2mcb9x.crl, http://crl.r2001.amazontrust.com/e3s12/7cmrfoBxcMh.crl, http://crl.r2001.amazontrust.com/e3s12/AWz8ZEEzGGY.crl, http://crl.r2001.amazontrust.com/e3s12/5I3xJxKT7ZY.crl, http://crl.r2001.amazontrust.com/e3s12/EGIySwAVDD2.crl, http://crl.r2001.amazontrust.com/e3s12/ERaA6rTBaW2.crl, http://crl.r2001.amazontrust.com/e3s12/OztStUPLQ9.crl, http://crl.r2001.amazontrust.com/e3s12/Bxmcj2sfdmS.crl, http://crl.r2001.amazontrust.com/e3s12/1oUrECaaS04.crl, http://crl.r2001.amazontrust.com/e3s12/1u9rVDXSnt9.crl, http://crl.r2001.amazontrust.com/e3s12/DGpgcKFQXXE.crl, http://crl.r2001.amazontrust.com/e3s12/1pU8fn5GAVb.crl, http://crl.r2001.amazontrust.com/e3s12/4SSCTWTmI4b.crl, http://crl.r2001.amazontrust.com/e3s12/JhNix9aDDUc.crl, http://crl.r2001.amazontrust.com/e3s12/9VF2zbQahyK.crl, http://crl.r2001.amazontrust.com/e3s12/IUjxQftzu94.crl, http://crl.r2001.amazontrust.com/e3s12/KWjeGbe9A1l.crl, http://crl.r2001.amazontrust.com/e3s12/DLyyldCMtUt.crl, http://crl.r2001.amazontrust.com/e3s12/LMdMzqCBbT1.crl, http://crl.r2001.amazontrust.com/e3s12/JWxJ71idTqv.crl, http://crl.r2001.amazontrust.com/e3s12/ByddaPvVESK.crl, http://crl.r2001.amazontrust.com/e3s12/GrSVNglCvV6.crl, http://crl.r2001.amazontrust.com/e3s12/2ZzqjlQRpcb.crl, http://crl.r2001.amazontrust.com/e3s12/6kOHXkslbGM.crl, http://crl.r2001.amazontrust.com/e3s12/7RYNWdt8h2B.crl, http://crl.r2001.amazontrust.com/e3s12/CjuxeyO8FYP.crl, http://crl.r2001.amazontrust.com/e3s12/CyRxYJUEXlF.crl, http://crl.r2001.amazontrust.com/e3s12/1pMRJYpRhRu.crl, http://crl.r2001.amazontrust.com/e3s12/FpO0r3m3clw.crl, http://crl.r2001.amazontrust.com/e3s12/3R8PEYP135e.crl, http://crl.r2001.amazontrust.com/e3s12/EpXp3a8IdRi.crl, http://crl.r2001.amazontrust.com/e3s12/Eyu1hEcQXiM.crl, http://crl.r2001.amazontrust.com/e3s12/1rXJ1JlITrF.crl, http://crl.r2001.amazontrust.com/e3s12/48CRkJqHZxN.crl, http://crl.r2001.amazontrust.com/e3s12/7ZdWA0Kdp0H.crl, http://crl.r2001.amazontrust.com/e3s12/JxOLoEbmzsQ.crl, http://crl.r2001.amazontrust.com/e3s12/3ThqVroxIFP.crl, http://crl.r2001.amazontrust.com/e3s12/FnQa5I222gu.crl, http://crl.r2001.amazontrust.com/e3s12/AlvuYF0WGxH.crl, http://crl.r2001.amazontrust.com/e3s12/7t6Gxe7SIfQ.crl, http://crl.r2001.amazontrust.com/e3s12/9OCn6aZ9Dv6.crl, http://crl.r2001.amazontrust.com/e3s12/7LhmzmpGQos.crl, http://crl.r2001.amazontrust.com/e3s12/SXT4GMAouU.crl, http://crl.r2001.amazontrust.com/e3s12/9TCcNWow44t.crl, http://crl.r2001.amazontrust.com/e3s12/4RvsJN4zSVy.crl, http://crl.r2001.amazontrust.com/e3s12/5HSRdxIiVIu.crl, http://crl.r2001.amazontrust.com/e3s12/4cSZXYtjRnq.crl, http://crl.r2001.amazontrust.com/e3s12/BDUQtDQEEQk.crl, http://crl.r2001.amazontrust.com/e3s12/7ELhtqO0mjn.crl, http://crl.r2001.amazontrust.com/e3s12/8D4BaENtMhO.crl, http://crl.r2001.amazontrust.com/e3s12/5ksjuWHWDMV.crl, http://crl.r2001.amazontrust.com/e3s12/7ZEMBySEL38.crl, http://crl.r2001.amazontrust.com/e3s12/KMUkt8dppkb.crl, http://crl.r2001.amazontrust.com/e3s12/AKlBzcdsMLo.crl, http://crl.r2001.amazontrust.com/e3s12/AQGnKbPOmKP.crl, http://crl.r2001.amazontrust.com/e3s12/6LDzQA88Dcf.crl, http://crl.r2001.amazontrust.com/e3s12/FqRCMqeSK9I.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            34:a5:b7:00:60:1b:e0:40:1d:cb:23:87:d9:5b:e4:18:09:78:ec:c7
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Apr 22 19:26:31 2026 GMT
            Not After : Apr 21 19:26:31 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S12
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                AC:D7:0D:CE:91:F9:8C:5B:0A:4C:36:CA:31:44:7C:8B:BE:5B:EF:10
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: B52C4ABE186527B88AFFCCFD71830ECAF31155C1CD8369BB99D1338FCA081FEC
    SPKI SHA256: 3A520822370917B114EDD1AADDFA9D1FB688E570767FE05470E61F1AF0F0CF62
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S13

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S13
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 195ED42F86D67881A517BFA377F22DFF6992DC7D
- SHA-256: 79984C553D755CF78F16F9CB899F060F9B45A97D2CB57C27F502B42C9B1EC479
- SPKI SHA-256: 42FC80D115BC430FB0716BFD26DA53F56B6CC5B233D44B7EF2B68CAD7D246380
- Validity: 2026-04-22 to 2029-04-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r2001.amazontrust.com/e3s13/8d9973aa-cdc9-42e4-8486-04cd4c53e228.crl, http://crl.r2001.amazontrust.com/e3s13/4qEpJcfrT7P.crl, http://crl.r2001.amazontrust.com/e3s13/8fziJu91oyT.crl, http://crl.r2001.amazontrust.com/e3s13/Izby5xyEeDc.crl, http://crl.r2001.amazontrust.com/e3s13/4UgLe8rCQ8q.crl, http://crl.r2001.amazontrust.com/e3s13/1HMJKEnFEJb.crl, http://crl.r2001.amazontrust.com/e3s13/AzOELxMMIgh.crl, http://crl.r2001.amazontrust.com/e3s13/AvwYwe9T9hd.crl, http://crl.r2001.amazontrust.com/e3s13/JcMlrpi92tT.crl, http://crl.r2001.amazontrust.com/e3s13/4ijiQmYRj8w.crl, http://crl.r2001.amazontrust.com/e3s13/6Bf3MvXBBcx.crl, http://crl.r2001.amazontrust.com/e3s13/FhZTFrild4f.crl, http://crl.r2001.amazontrust.com/e3s13/170ofWLu0f4.crl, http://crl.r2001.amazontrust.com/e3s13/FADKiTZ1ioy.crl, http://crl.r2001.amazontrust.com/e3s13/A1CAfnUuLlK.crl, http://crl.r2001.amazontrust.com/e3s13/4RgoKo3yZuf.crl, http://crl.r2001.amazontrust.com/e3s13/JlZ9N6Ce1Hj.crl, http://crl.r2001.amazontrust.com/e3s13/GWEZPslCPxa.crl, http://crl.r2001.amazontrust.com/e3s13/3v5wTBdhojC.crl, http://crl.r2001.amazontrust.com/e3s13/5VXqPXtcXT6.crl, http://crl.r2001.amazontrust.com/e3s13/JZJB0cY0jZI.crl, http://crl.r2001.amazontrust.com/e3s13/BTEpPmYcsFs.crl, http://crl.r2001.amazontrust.com/e3s13/AuGi9cWhcsv.crl, http://crl.r2001.amazontrust.com/e3s13/2DnAY4ob4pZ.crl, http://crl.r2001.amazontrust.com/e3s13/Dqtwv3nblGi.crl, http://crl.r2001.amazontrust.com/e3s13/3fdkoCOeDio.crl, http://crl.r2001.amazontrust.com/e3s13/BZv5LPeHhZU.crl, http://crl.r2001.amazontrust.com/e3s13/F0DxLQ0JzMn.crl, http://crl.r2001.amazontrust.com/e3s13/Fub2xJhzLE5.crl, http://crl.r2001.amazontrust.com/e3s13/JVt9NCydMLo.crl, http://crl.r2001.amazontrust.com/e3s13/2E1M54D7EpB.crl, http://crl.r2001.amazontrust.com/e3s13/9NmpNj4gw39.crl, http://crl.r2001.amazontrust.com/e3s13/9ggBpXxFUpG.crl, http://crl.r2001.amazontrust.com/e3s13/9tlmj6tAsqZ.crl, http://crl.r2001.amazontrust.com/e3s13/B99KrpQqYiU.crl, http://crl.r2001.amazontrust.com/e3s13/EtsYj1lxkmk.crl, http://crl.r2001.amazontrust.com/e3s13/I6IltlmuvlO.crl, http://crl.r2001.amazontrust.com/e3s13/JJdiaFlto26.crl, http://crl.r2001.amazontrust.com/e3s13/L3JPuEnrqW5.crl, http://crl.r2001.amazontrust.com/e3s13/zt7YWjH0w1.crl, http://crl.r2001.amazontrust.com/e3s13/2HZbAaAU1jx.crl, http://crl.r2001.amazontrust.com/e3s13/HGEu33wUGxa.crl, http://crl.r2001.amazontrust.com/e3s13/LxUhgDyxKoP.crl, http://crl.r2001.amazontrust.com/e3s13/FHvEyodzbLD.crl, http://crl.r2001.amazontrust.com/e3s13/H8r2O0Fnz0j.crl, http://crl.r2001.amazontrust.com/e3s13/Hnn79TSVB0X.crl, http://crl.r2001.amazontrust.com/e3s13/48F7rYw8wZB.crl, http://crl.r2001.amazontrust.com/e3s13/IPpDSTvcm2G.crl, http://crl.r2001.amazontrust.com/e3s13/1OXA5lyUA9c.crl, http://crl.r2001.amazontrust.com/e3s13/BxNgtBJDCE4.crl, http://crl.r2001.amazontrust.com/e3s13/JsJXMyYmYJe.crl, http://crl.r2001.amazontrust.com/e3s13/J9HWlbAsqJP.crl, http://crl.r2001.amazontrust.com/e3s13/dd1N7C7abe.crl, http://crl.r2001.amazontrust.com/e3s13/Awxwevi7z7E.crl, http://crl.r2001.amazontrust.com/e3s13/BXrIaK5kkdr.crl, http://crl.r2001.amazontrust.com/e3s13/32UWdqSUGoH.crl, http://crl.r2001.amazontrust.com/e3s13/EWKaS5DQk5D.crl, http://crl.r2001.amazontrust.com/e3s13/H50rkWK7JGq.crl, http://crl.r2001.amazontrust.com/e3s13/EaWIMTXsrx8.crl, http://crl.r2001.amazontrust.com/e3s13/ETyymxlFHSE.crl, http://crl.r2001.amazontrust.com/e3s13/GTmg6TPZKHJ.crl, http://crl.r2001.amazontrust.com/e3s13/42XyIVbaBB5.crl, http://crl.r2001.amazontrust.com/e3s13/AqCwerqRgdZ.crl, http://crl.r2001.amazontrust.com/e3s13/1HeSsF3zjpP.crl, http://crl.r2001.amazontrust.com/e3s13/48qUjRsFzYA.crl, http://crl.r2001.amazontrust.com/e3s13/2mpBqbyfkir.crl, http://crl.r2001.amazontrust.com/e3s13/AvsKgweHUuk.crl, http://crl.r2001.amazontrust.com/e3s13/LaFqhOb4d1N.crl, http://crl.r2001.amazontrust.com/e3s13/4PKcxScjFSP.crl, http://crl.r2001.amazontrust.com/e3s13/5oFBps6HDCJ.crl, http://crl.r2001.amazontrust.com/e3s13/6NkqB6uGogU.crl, http://crl.r2001.amazontrust.com/e3s13/K1wZz3yBVZa.crl, http://crl.r2001.amazontrust.com/e3s13/57NB1M6vAMW.crl, http://crl.r2001.amazontrust.com/e3s13/C3Ghq3oGUg1.crl, http://crl.r2001.amazontrust.com/e3s13/4lXYYEcTdeZ.crl, http://crl.r2001.amazontrust.com/e3s13/KxgKkckCp8d.crl, http://crl.r2001.amazontrust.com/e3s13/5QR0En1sPM8.crl, http://crl.r2001.amazontrust.com/e3s13/ANANYI8sjtH.crl, http://crl.r2001.amazontrust.com/e3s13/6rM0dIW1IdM.crl, http://crl.r2001.amazontrust.com/e3s13/EC32edzgwhQ.crl, http://crl.r2001.amazontrust.com/e3s13/EY8sx7dsDYA.crl, http://crl.r2001.amazontrust.com/e3s13/1pXnRNSqK6B.crl, http://crl.r2001.amazontrust.com/e3s13/LsKA4Wl5riI.crl, http://crl.r2001.amazontrust.com/e3s13/3R6rFyhtpsV.crl, http://crl.r2001.amazontrust.com/e3s13/5GzwkflDE8h.crl, http://crl.r2001.amazontrust.com/e3s13/8W1fSO5687b.crl, http://crl.r2001.amazontrust.com/e3s13/9mvsNTC1Sob.crl, http://crl.r2001.amazontrust.com/e3s13/6ANZs383WyA.crl, http://crl.r2001.amazontrust.com/e3s13/ElKMXv9KSmc.crl, http://crl.r2001.amazontrust.com/e3s13/4MmVIjU0JmE.crl, http://crl.r2001.amazontrust.com/e3s13/K4R5USPQHae.crl, http://crl.r2001.amazontrust.com/e3s13/E5xL6rJKRDT.crl, http://crl.r2001.amazontrust.com/e3s13/2kYdJxb5L9t.crl, http://crl.r2001.amazontrust.com/e3s13/8nWjL8l18SZ.crl, http://crl.r2001.amazontrust.com/e3s13/84Op73gOm97.crl, http://crl.r2001.amazontrust.com/e3s13/8H0dmUC074s.crl, http://crl.r2001.amazontrust.com/e3s13/4qJpUV8VWRi.crl, http://crl.r2001.amazontrust.com/e3s13/GV2SxqUamc.crl, http://crl.r2001.amazontrust.com/e3s13/7O26rz3hs0U.crl, http://crl.r2001.amazontrust.com/e3s13/DAiF3ELAUMd.crl, http://crl.r2001.amazontrust.com/e3s13/KS8yagUmDfh.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            19:5e:d4:2f:86:d6:78:81:a5:17:bf:a3:77:f2:2d:ff:69:92:dc:7d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Apr 22 19:26:36 2026 GMT
            Not After : Apr 21 19:26:36 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S13
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                B8:80:71:5C:B5:65:0D:38:E0:10:C4:68:20:49:F7:38:E6:4D:78:DF
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 79984C553D755CF78F16F9CB899F060F9B45A97D2CB57C27F502B42C9B1EC479
    SPKI SHA256: 42FC80D115BC430FB0716BFD26DA53F56B6CC5B233D44B7EF2B68CAD7D246380
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S14

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S14
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 6CD0E01A8538B777BE1BC7BEF7EE9E2A1867251D
- SHA-256: 5097C042BA4628C18628FEF301F5798F3BCA5D3097DA3EDF30AF0C2AB4DC2263
- SPKI SHA-256: 4E6270B90CC3298B8445A56DCA79D6B32AB84735788EA5009D1DBE77B26E75D2
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6c:d0:e0:1a:85:38:b7:77:be:1b:c7:be:f7:ee:9e:2a:18:67:25:1d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:30:05 2026 GMT
            Not After : Jul  7 19:30:05 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S14
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                C0:7B:47:59:89:EC:0D:C3:8D:D9:6D:75:D3:A9:F8:0B:E2:A2:97:38
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5097C042BA4628C18628FEF301F5798F3BCA5D3097DA3EDF30AF0C2AB4DC2263
    SPKI SHA256: 4E6270B90CC3298B8445A56DCA79D6B32AB84735788EA5009D1DBE77B26E75D2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S15

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S15
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 276015F8F4C812D16C88FCA67B850DDB421ED785
- SHA-256: 2F2BCDCD54F26CEF3878F6E6694CA13016D6A11A1AE82788209B7B196C5D568D
- SPKI SHA-256: AB68DE4C66D86D034CB8112EE3EFF3FED6B89C7E829EB45B9FA5D0847024C4D2
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            27:60:15:f8:f4:c8:12:d1:6c:88:fc:a6:7b:85:0d:db:42:1e:d7:85
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:30:10 2026 GMT
            Not After : Jul  7 19:30:10 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S15
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                AD:FF:00:3C:6F:B3:F2:22:5C:43:C2:65:11:4C:C8:93:D9:65:EA:B0
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 2F2BCDCD54F26CEF3878F6E6694CA13016D6A11A1AE82788209B7B196C5D568D
    SPKI SHA256: AB68DE4C66D86D034CB8112EE3EFF3FED6B89C7E829EB45B9FA5D0847024C4D2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S16

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S16
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 226B6437DFBE497C176264DA4E8D3D1856882A11
- SHA-256: B34E17C32AFC8957FEFF7D0EF5F9FB389D450C32A238E0869642DD21DFC58855
- SPKI SHA-256: 4C06EE93030A0D5FA9BA76EBE4A82554066C3180A8EC3EE52E6F7DF39109AF0D
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:6b:64:37:df:be:49:7c:17:62:64:da:4e:8d:3d:18:56:88:2a:11
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:30:15 2026 GMT
            Not After : Jul  7 19:30:15 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S16
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                0E:9B:D4:9F:FE:01:63:CE:77:17:14:93:DC:DA:32:3E:83:D0:98:67
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: B34E17C32AFC8957FEFF7D0EF5F9FB389D450C32A238E0869642DD21DFC58855
    SPKI SHA256: 4C06EE93030A0D5FA9BA76EBE4A82554066C3180A8EC3EE52E6F7DF39109AF0D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S17

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S17
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 4A6C2E279A76F00B36E9C7FF6E29EABDB9060622
- SHA-256: 0329A16CA4468E1B47C5CA2A58F5F87824508046F15C35267D6B8D2CC69F3FF3
- SPKI SHA-256: D5F86FF7847F37C7E96365D473C49B668D25410E5BD733DCACCED6618A98996A
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4a:6c:2e:27:9a:76:f0:0b:36:e9:c7:ff:6e:29:ea:bd:b9:06:06:22
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:30:20 2026 GMT
            Not After : Jul  7 19:30:20 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S17
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                CA:82:BA:44:75:B8:0F:C3:84:33:15:A9:28:E8:67:40:04:53:27:7D
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 0329A16CA4468E1B47C5CA2A58F5F87824508046F15C35267D6B8D2CC69F3FF3
    SPKI SHA256: D5F86FF7847F37C7E96365D473C49B668D25410E5BD733DCACCED6618A98996A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S18

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S18
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 49BCF0528E7EBD3A61C4A3C803C9D45EBA2083EE
- SHA-256: 86048C1D12E93D6950D1553485C90EBFA39E0BAD02A435D9724B0A95E5A4241F
- SPKI SHA-256: DBF60FD08CC34D7CA870B0AE836D8AC16B906E3A0D186B2DCF3345AD65144B91
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            49:bc:f0:52:8e:7e:bd:3a:61:c4:a3:c8:03:c9:d4:5e:ba:20:83:ee
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:30:25 2026 GMT
            Not After : Jul  7 19:30:25 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S18
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                3A:F8:9C:81:0D:2F:3B:31:3C:DD:0F:54:CA:5B:7A:1A:C3:DF:5C:99
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 86048C1D12E93D6950D1553485C90EBFA39E0BAD02A435D9724B0A95E5A4241F
    SPKI SHA256: DBF60FD08CC34D7CA870B0AE836D8AC16B906E3A0D186B2DCF3345AD65144B91
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S19

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S19
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 6B78AEB15DD9F52FC823648A344A2B58E352838A
- SHA-256: 2082A3883508038D41ECF5DEA56D870F391DBCEBC9C949056F718E8F0BEEC711
- SPKI SHA-256: 118FFACE3043F93711084634E225895269CFCB6F9452FE45A54C669FFF608D3C
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6b:78:ae:b1:5d:d9:f5:2f:c8:23:64:8a:34:4a:2b:58:e3:52:83:8a
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:30:30 2026 GMT
            Not After : Jul  7 19:30:30 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S19
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                64:5C:D5:A8:E8:D2:D5:6E:DB:BB:DD:74:42:A8:8F:9C:7E:45:85:C1
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 2082A3883508038D41ECF5DEA56D870F391DBCEBC9C949056F718E8F0BEEC711
    SPKI SHA256: 118FFACE3043F93711084634E225895269CFCB6F9452FE45A54C669FFF608D3C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S20

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S20
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 4AC2A2F7ECD2A5FA86B864D52FE33ED50E5D0A98
- SHA-256: 4C66F0EFF04D454B70895E85C6B7D90849D0B61DD8F2F0A7C5BDF3542E91A552
- SPKI SHA-256: F793B777E384A6D22B50EDB43F1EE9B23A2E95891B6875D1D0B05476519431D1
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4a:c2:a2:f7:ec:d2:a5:fa:86:b8:64:d5:2f:e3:3e:d5:0e:5d:0a:98
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:30:36 2026 GMT
            Not After : Jul  7 19:30:36 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S20
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                54:84:FD:46:A8:9F:37:AA:5C:FE:89:53:86:62:70:21:32:87:A9:00
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4C66F0EFF04D454B70895E85C6B7D90849D0B61DD8F2F0A7C5BDF3542E91A552
    SPKI SHA256: F793B777E384A6D22B50EDB43F1EE9B23A2E95891B6875D1D0B05476519431D1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S21

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S21
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 4B1FD29E64C2ED71C33EF56A37DBF20929ADBDAF
- SHA-256: 25675DC3724EDA70E715CBCB49F7D8609D174A3DFEA511F3F4C72890FC0CDFF3
- SPKI SHA-256: B960A364C4E906CA57524627CA7FF7F4B12FD5521EB52E8857F73ED8D8E4376A
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4b:1f:d2:9e:64:c2:ed:71:c3:3e:f5:6a:37:db:f2:09:29:ad:bd:af
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:30:41 2026 GMT
            Not After : Jul  7 19:30:41 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S21
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                EE:1E:50:8B:A8:AC:D5:D0:5D:E7:80:B3:28:96:57:0F:6C:8C:C5:C8
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 25675DC3724EDA70E715CBCB49F7D8609D174A3DFEA511F3F4C72890FC0CDFF3
    SPKI SHA256: B960A364C4E906CA57524627CA7FF7F4B12FD5521EB52E8857F73ED8D8E4376A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S22

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S22
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 59C32AC08AC0B553C404AE2057181308FCA7CB89
- SHA-256: 73F471734E0EAC3D4F5BFFF00E2754AD9ED999F6A1CFEA599945573B55C3ABD4
- SPKI SHA-256: FA96620185DEAD631236E627089EC2B204407884BA90F7F8304DE0D22AE9863C
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.e3s22.amazontrust.com/fd8efd91-75cb-4a4e-9f4c-eeff846926dd.crl, http://crl.e3s22.amazontrust.com/1M1JW.crl, http://crl.e3s22.amazontrust.com/Ao6x3.crl, http://crl.e3s22.amazontrust.com/DFyqM.crl, http://crl.e3s22.amazontrust.com/Cs7To.crl, http://crl.e3s22.amazontrust.com/H7o4U.crl, http://crl.e3s22.amazontrust.com/J5ryQ.crl, http://crl.e3s22.amazontrust.com/9CdLE.crl, http://crl.e3s22.amazontrust.com/8JlXy.crl, http://crl.e3s22.amazontrust.com/5izdy.crl, http://crl.e3s22.amazontrust.com/KKIrZ.crl, http://crl.e3s22.amazontrust.com/EVPJS.crl, http://crl.e3s22.amazontrust.com/3l0I2.crl, http://crl.e3s22.amazontrust.com/FMt3I.crl, http://crl.e3s22.amazontrust.com/13LoA.crl, http://crl.e3s22.amazontrust.com/HOmbb.crl, http://crl.e3s22.amazontrust.com/JRfFU.crl, http://crl.e3s22.amazontrust.com/DLAHU.crl, http://crl.e3s22.amazontrust.com/6DyGe.crl, http://crl.e3s22.amazontrust.com/4k6xp.crl, http://crl.e3s22.amazontrust.com/DHcjr.crl, http://crl.e3s22.amazontrust.com/E37zK.crl, http://crl.e3s22.amazontrust.com/FRq8l.crl, http://crl.e3s22.amazontrust.com/C8zCr.crl, http://crl.e3s22.amazontrust.com/3Jbiz.crl, http://crl.e3s22.amazontrust.com/BcWM8.crl, http://crl.e3s22.amazontrust.com/EO0aW.crl, http://crl.e3s22.amazontrust.com/KyXKH.crl, http://crl.e3s22.amazontrust.com/FZluM.crl, http://crl.e3s22.amazontrust.com/Eu1o9.crl, http://crl.e3s22.amazontrust.com/AVD7x.crl, http://crl.e3s22.amazontrust.com/FoUch.crl, http://crl.e3s22.amazontrust.com/KYyyy.crl, http://crl.e3s22.amazontrust.com/191JJ.crl, http://crl.e3s22.amazontrust.com/9GFsw.crl, http://crl.e3s22.amazontrust.com/2Js7q.crl, http://crl.e3s22.amazontrust.com/5Wi5y.crl, http://crl.e3s22.amazontrust.com/LF1F4.crl, http://crl.e3s22.amazontrust.com/E6E3A.crl, http://crl.e3s22.amazontrust.com/GeOL1.crl, http://crl.e3s22.amazontrust.com/1Be6r.crl, http://crl.e3s22.amazontrust.com/EQJs3.crl, http://crl.e3s22.amazontrust.com/GWYL8.crl, http://crl.e3s22.amazontrust.com/7Qg8M.crl, http://crl.e3s22.amazontrust.com/HUgtE.crl, http://crl.e3s22.amazontrust.com/1XhwU.crl, http://crl.e3s22.amazontrust.com/6K6Cq.crl, http://crl.e3s22.amazontrust.com/L2lIV.crl, http://crl.e3s22.amazontrust.com/6Ejo7.crl, http://crl.e3s22.amazontrust.com/HpNH6.crl, http://crl.e3s22.amazontrust.com/AhEeU.crl, http://crl.e3s22.amazontrust.com/92tUz.crl, http://crl.e3s22.amazontrust.com/6wXRG.crl, http://crl.e3s22.amazontrust.com/9G6pD.crl, http://crl.e3s22.amazontrust.com/2mu8J.crl, http://crl.e3s22.amazontrust.com/5afVv.crl, http://crl.e3s22.amazontrust.com/8x8mk.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            59:c3:2a:c0:8a:c0:b5:53:c4:04:ae:20:57:18:13:08:fc:a7:cb:89
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:30:46 2026 GMT
            Not After : Jul  7 19:30:46 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S22
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                B5:61:23:31:12:76:0C:86:1F:3A:51:36:21:90:49:D4:BF:B4:25:D2
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 73F471734E0EAC3D4F5BFFF00E2754AD9ED999F6A1CFEA599945573B55C3ABD4
    SPKI SHA256: FA96620185DEAD631236E627089EC2B204407884BA90F7F8304DE0D22AE9863C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S23

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S23
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 14A53106D011F0234A9A26AD70845D822BEB3775
- SHA-256: 47C8737DBFE93C308E418AB1D3F344880D24062158F079E5011826629830DF9B
- SPKI SHA-256: 08D5BC392EA64CDE157A7750D4B1DFD812DFD4775C2F222450853D7906F9D482
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.e3s23.amazontrust.com/21c0044b-8d77-4351-aa0c-9d461486c9e5.crl, http://crl.e3s23.amazontrust.com/mb8nY.crl, http://crl.e3s23.amazontrust.com/EGYne.crl, http://crl.e3s23.amazontrust.com/DDpJ3.crl, http://crl.e3s23.amazontrust.com/2XwI7.crl, http://crl.e3s23.amazontrust.com/5cJmI.crl, http://crl.e3s23.amazontrust.com/CpjAT.crl, http://crl.e3s23.amazontrust.com/Hl1N0.crl, http://crl.e3s23.amazontrust.com/JgxOK.crl, http://crl.e3s23.amazontrust.com/4ftpe.crl, http://crl.e3s23.amazontrust.com/84kCq.crl, http://crl.e3s23.amazontrust.com/8XiNu.crl, http://crl.e3s23.amazontrust.com/5zxXk.crl, http://crl.e3s23.amazontrust.com/JCZ2w.crl, http://crl.e3s23.amazontrust.com/JdHD2.crl, http://crl.e3s23.amazontrust.com/5pT4x.crl, http://crl.e3s23.amazontrust.com/JlqvK.crl, http://crl.e3s23.amazontrust.com/2GKkk.crl, http://crl.e3s23.amazontrust.com/GnGTO.crl, http://crl.e3s23.amazontrust.com/GyOHg.crl, http://crl.e3s23.amazontrust.com/1FkyX.crl, http://crl.e3s23.amazontrust.com/HxKdm.crl, http://crl.e3s23.amazontrust.com/IwVHW.crl, http://crl.e3s23.amazontrust.com/Etawh.crl, http://crl.e3s23.amazontrust.com/LPuVG.crl, http://crl.e3s23.amazontrust.com/App8l.crl, http://crl.e3s23.amazontrust.com/1ZyRP.crl, http://crl.e3s23.amazontrust.com/8PLWn.crl, http://crl.e3s23.amazontrust.com/Cg4QM.crl, http://crl.e3s23.amazontrust.com/D0hTE.crl, http://crl.e3s23.amazontrust.com/LZt0M.crl, http://crl.e3s23.amazontrust.com/3ZjWU.crl, http://crl.e3s23.amazontrust.com/2eZ4P.crl, http://crl.e3s23.amazontrust.com/J8ZQU.crl, http://crl.e3s23.amazontrust.com/5MiHq.crl, http://crl.e3s23.amazontrust.com/LJQA6.crl, http://crl.e3s23.amazontrust.com/2HZh6.crl, http://crl.e3s23.amazontrust.com/2giEa.crl, http://crl.e3s23.amazontrust.com/3erIw.crl, http://crl.e3s23.amazontrust.com/DE9GV.crl, http://crl.e3s23.amazontrust.com/IQgq1.crl, http://crl.e3s23.amazontrust.com/CXshi.crl, http://crl.e3s23.amazontrust.com/JZvSU.crl, http://crl.e3s23.amazontrust.com/65SEb.crl, http://crl.e3s23.amazontrust.com/9LToN.crl, http://crl.e3s23.amazontrust.com/9kKOS.crl, http://crl.e3s23.amazontrust.com/IxLsH.crl, http://crl.e3s23.amazontrust.com/LMWul.crl, http://crl.e3s23.amazontrust.com/C4jrY.crl, http://crl.e3s23.amazontrust.com/6ep2p.crl, http://crl.e3s23.amazontrust.com/3zhTq.crl, http://crl.e3s23.amazontrust.com/9agBw.crl, http://crl.e3s23.amazontrust.com/LZN76.crl, http://crl.e3s23.amazontrust.com/7jIfu.crl, http://crl.e3s23.amazontrust.com/DbPV1.crl, http://crl.e3s23.amazontrust.com/2XBNT.crl, http://crl.e3s23.amazontrust.com/K6U6E.crl, http://crl.e3s23.amazontrust.com/Aj95G.crl, http://crl.e3s23.amazontrust.com/GqxgK.crl, http://crl.e3s23.amazontrust.com/K4Wun.crl, http://crl.e3s23.amazontrust.com/1Kd2Q.crl, http://crl.e3s23.amazontrust.com/EoYsU.crl, http://crl.e3s23.amazontrust.com/LoEH0.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            14:a5:31:06:d0:11:f0:23:4a:9a:26:ad:70:84:5d:82:2b:eb:37:75
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:30:51 2026 GMT
            Not After : Jul  7 19:30:51 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S23
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                5B:AA:16:86:73:F1:5F:13:D0:C2:41:B0:88:BD:F3:FB:1A:60:AC:42
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 47C8737DBFE93C308E418AB1D3F344880D24062158F079E5011826629830DF9B
    SPKI SHA256: 08D5BC392EA64CDE157A7750D4B1DFD812DFD4775C2F222450853D7906F9D482
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S24

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S24
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 1033B88D61D574C3BA00B9792C73A5512632DE07
- SHA-256: 17B5DE715F822FE2C03E0386124FDF5508DAADEB2F096BE8F7B1F6B87F9B25B2
- SPKI SHA-256: DA4770028CD8D8C183FA625A7CDC08A43160811901EA1F25F80D2368DB87D5AC
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.e3s24.amazontrust.com/e99d5f60-72ee-415e-b6ce-e5cbc971eabb.crl, http://crl.e3s24.amazontrust.com/8Y3Wk.crl, http://crl.e3s24.amazontrust.com/5rZMV.crl, http://crl.e3s24.amazontrust.com/4kdg0.crl, http://crl.e3s24.amazontrust.com/5bOEE.crl, http://crl.e3s24.amazontrust.com/DANtT.crl, http://crl.e3s24.amazontrust.com/DTufL.crl, http://crl.e3s24.amazontrust.com/I1ES1.crl, http://crl.e3s24.amazontrust.com/oFnE6.crl, http://crl.e3s24.amazontrust.com/LuDfD.crl, http://crl.e3s24.amazontrust.com/5IpY3.crl, http://crl.e3s24.amazontrust.com/GALJE.crl, http://crl.e3s24.amazontrust.com/A5SQm.crl, http://crl.e3s24.amazontrust.com/6B2Ei.crl, http://crl.e3s24.amazontrust.com/CAdtW.crl, http://crl.e3s24.amazontrust.com/EfehG.crl, http://crl.e3s24.amazontrust.com/4XSuM.crl, http://crl.e3s24.amazontrust.com/LrY6e.crl, http://crl.e3s24.amazontrust.com/f08Tp.crl, http://crl.e3s24.amazontrust.com/4J5zs.crl, http://crl.e3s24.amazontrust.com/DIc0w.crl, http://crl.e3s24.amazontrust.com/AreEN.crl, http://crl.e3s24.amazontrust.com/Fk7gv.crl, http://crl.e3s24.amazontrust.com/IgO0x.crl, http://crl.e3s24.amazontrust.com/1ec8S.crl, http://crl.e3s24.amazontrust.com/CgIh5.crl, http://crl.e3s24.amazontrust.com/DEudQ.crl, http://crl.e3s24.amazontrust.com/GnJeX.crl, http://crl.e3s24.amazontrust.com/LQ873.crl, http://crl.e3s24.amazontrust.com/ICV4p.crl, http://crl.e3s24.amazontrust.com/1f78E.crl, http://crl.e3s24.amazontrust.com/2J2vt.crl, http://crl.e3s24.amazontrust.com/F51wz.crl, http://crl.e3s24.amazontrust.com/LlS7d.crl, http://crl.e3s24.amazontrust.com/HCY4H.crl, http://crl.e3s24.amazontrust.com/5p9cY.crl, http://crl.e3s24.amazontrust.com/Gu5Er.crl, http://crl.e3s24.amazontrust.com/CvovU.crl, http://crl.e3s24.amazontrust.com/Lc0WZ.crl, http://crl.e3s24.amazontrust.com/2ArMz.crl, http://crl.e3s24.amazontrust.com/7KoqO.crl, http://crl.e3s24.amazontrust.com/E9Bzg.crl, http://crl.e3s24.amazontrust.com/ADIVt.crl, http://crl.e3s24.amazontrust.com/Czh21.crl, http://crl.e3s24.amazontrust.com/KgL2k.crl, http://crl.e3s24.amazontrust.com/23PsY.crl, http://crl.e3s24.amazontrust.com/5v2en.crl, http://crl.e3s24.amazontrust.com/HPMEL.crl, http://crl.e3s24.amazontrust.com/ENtHY.crl, http://crl.e3s24.amazontrust.com/23dRe.crl, http://crl.e3s24.amazontrust.com/E9sn6.crl, http://crl.e3s24.amazontrust.com/HsTvs.crl, http://crl.e3s24.amazontrust.com/J2UUj.crl, http://crl.e3s24.amazontrust.com/xKyVu.crl, http://crl.e3s24.amazontrust.com/DoNSh.crl, http://crl.e3s24.amazontrust.com/6iMza.crl, http://crl.e3s24.amazontrust.com/7WLS1.crl, http://crl.e3s24.amazontrust.com/4v7NA.crl, http://crl.e3s24.amazontrust.com/HLlXU.crl, http://crl.e3s24.amazontrust.com/QGgJo.crl, http://crl.e3s24.amazontrust.com/1FEBD.crl, http://crl.e3s24.amazontrust.com/02Wow.crl, http://crl.e3s24.amazontrust.com/Fkvzv.crl, http://crl.e3s24.amazontrust.com/KTK1n.crl, http://crl.e3s24.amazontrust.com/5Pjyq.crl, http://crl.e3s24.amazontrust.com/JgNcy.crl, http://crl.e3s24.amazontrust.com/JM31K.crl, http://crl.e3s24.amazontrust.com/7CBrc.crl, http://crl.e3s24.amazontrust.com/8O8VO.crl, http://crl.e3s24.amazontrust.com/JsX5l.crl, http://crl.e3s24.amazontrust.com/GyTa0.crl, http://crl.e3s24.amazontrust.com/deDMU.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            10:33:b8:8d:61:d5:74:c3:ba:00:b9:79:2c:73:a5:51:26:32:de:07
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:30:56 2026 GMT
            Not After : Jul  7 19:30:56 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S24
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                2A:08:0C:36:B2:E0:90:A0:A1:55:80:F7:99:FB:F8:A9:9E:B4:0B:90
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 17B5DE715F822FE2C03E0386124FDF5508DAADEB2F096BE8F7B1F6B87F9B25B2
    SPKI SHA256: DA4770028CD8D8C183FA625A7CDC08A43160811901EA1F25F80D2368DB87D5AC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S25

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S25
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 2AFC76CADF89290595EB840A507FBBE1E1BF424D
- SHA-256: ECCF61E6146D84039AE0763F49B2D7C15022B1426256F92401EE10BF326EA6CB
- SPKI SHA-256: 8A133B5670D3C00916E60CA1C02A6FB9AD7024FFC9B8DF8AC4C14C74AA7F0973
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.e3s25.amazontrust.com/56962d25-481a-4577-acbf-f69b30659d6a.crl, http://crl.e3s25.amazontrust.com/20k5X.crl, http://crl.e3s25.amazontrust.com/7oy4Q.crl, http://crl.e3s25.amazontrust.com/67EqG.crl, http://crl.e3s25.amazontrust.com/AXbvC.crl, http://crl.e3s25.amazontrust.com/5LwBr.crl, http://crl.e3s25.amazontrust.com/FFJjt.crl, http://crl.e3s25.amazontrust.com/Lh1xM.crl, http://crl.e3s25.amazontrust.com/C4rxK.crl, http://crl.e3s25.amazontrust.com/8wf0d.crl, http://crl.e3s25.amazontrust.com/B9KN6.crl, http://crl.e3s25.amazontrust.com/DnNC0.crl, http://crl.e3s25.amazontrust.com/KMdL0.crl, http://crl.e3s25.amazontrust.com/FdYAz.crl, http://crl.e3s25.amazontrust.com/JRWan.crl, http://crl.e3s25.amazontrust.com/3VkP8.crl, http://crl.e3s25.amazontrust.com/A6t2B.crl, http://crl.e3s25.amazontrust.com/XL1XI.crl, http://crl.e3s25.amazontrust.com/6sXmh.crl, http://crl.e3s25.amazontrust.com/7MrcL.crl, http://crl.e3s25.amazontrust.com/5zBa4.crl, http://crl.e3s25.amazontrust.com/1sCtQ.crl, http://crl.e3s25.amazontrust.com/2kP2g.crl, http://crl.e3s25.amazontrust.com/3nvSH.crl, http://crl.e3s25.amazontrust.com/EkPKP.crl, http://crl.e3s25.amazontrust.com/Gho7F.crl, http://crl.e3s25.amazontrust.com/AdkkA.crl, http://crl.e3s25.amazontrust.com/CEuK9.crl, http://crl.e3s25.amazontrust.com/Bmpkl.crl, http://crl.e3s25.amazontrust.com/LFnVM.crl, http://crl.e3s25.amazontrust.com/7Ux3P.crl, http://crl.e3s25.amazontrust.com/8ovPy.crl, http://crl.e3s25.amazontrust.com/AvagP.crl, http://crl.e3s25.amazontrust.com/EnxQr.crl, http://crl.e3s25.amazontrust.com/6fqG0.crl, http://crl.e3s25.amazontrust.com/BZwHY.crl, http://crl.e3s25.amazontrust.com/JsuHQ.crl, http://crl.e3s25.amazontrust.com/4mpBL.crl, http://crl.e3s25.amazontrust.com/3O7gz.crl, http://crl.e3s25.amazontrust.com/8ZMv5.crl, http://crl.e3s25.amazontrust.com/1kVCL.crl, http://crl.e3s25.amazontrust.com/GpwYv.crl, http://crl.e3s25.amazontrust.com/7ofZ6.crl, http://crl.e3s25.amazontrust.com/BRqsS.crl, http://crl.e3s25.amazontrust.com/DhI4T.crl, http://crl.e3s25.amazontrust.com/6YTyq.crl, http://crl.e3s25.amazontrust.com/A9bui.crl, http://crl.e3s25.amazontrust.com/I2aRp.crl, http://crl.e3s25.amazontrust.com/IVad3.crl, http://crl.e3s25.amazontrust.com/wPIvf.crl, http://crl.e3s25.amazontrust.com/9qAXM.crl, http://crl.e3s25.amazontrust.com/2APUo.crl, http://crl.e3s25.amazontrust.com/9MKob.crl, http://crl.e3s25.amazontrust.com/J3GJJ.crl, http://crl.e3s25.amazontrust.com/Fo8uU.crl, http://crl.e3s25.amazontrust.com/72aik.crl, http://crl.e3s25.amazontrust.com/IueP4.crl, http://crl.e3s25.amazontrust.com/FaOhE.crl, http://crl.e3s25.amazontrust.com/49GXD.crl, http://crl.e3s25.amazontrust.com/GCc0O.crl, http://crl.e3s25.amazontrust.com/LAQ0n.crl, http://crl.e3s25.amazontrust.com/5Fs9Q.crl, http://crl.e3s25.amazontrust.com/nC26l.crl, http://crl.e3s25.amazontrust.com/FByRb.crl, http://crl.e3s25.amazontrust.com/E4jmK.crl, http://crl.e3s25.amazontrust.com/5QQez.crl, http://crl.e3s25.amazontrust.com/4Qclf.crl, http://crl.e3s25.amazontrust.com/4ihbs.crl, http://crl.e3s25.amazontrust.com/KzcNc.crl, http://crl.e3s25.amazontrust.com/KxmiL.crl, http://crl.e3s25.amazontrust.com/HtVYo.crl, http://crl.e3s25.amazontrust.com/65TG2.crl, http://crl.e3s25.amazontrust.com/LX1Aa.crl, http://crl.e3s25.amazontrust.com/BM6vM.crl, http://crl.e3s25.amazontrust.com/HgtOR.crl, http://crl.e3s25.amazontrust.com/8LWgc.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2a:fc:76:ca:df:89:29:05:95:eb:84:0a:50:7f:bb:e1:e1:bf:42:4d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:31:01 2026 GMT
            Not After : Jul  7 19:31:01 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S25
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                E5:68:81:EB:95:E5:00:90:4C:17:2C:2D:64:1B:1D:B2:2D:CE:F8:78
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: ECCF61E6146D84039AE0763F49B2D7C15022B1426256F92401EE10BF326EA6CB
    SPKI SHA256: 8A133B5670D3C00916E60CA1C02A6FB9AD7024FFC9B8DF8AC4C14C74AA7F0973
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S26

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S26
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 58339BDD4E2633EF53C5736F111C846E68973206
- SHA-256: EB08D293792D3960AF4EE1449571EF064B6ECFB5033A932C4F4F634927A86A5C
- SPKI SHA-256: CE34A114A60C55ED57A6107A5C37021603139191CA9785213886344302317DA3
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            58:33:9b:dd:4e:26:33:ef:53:c5:73:6f:11:1c:84:6e:68:97:32:06
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:31:06 2026 GMT
            Not After : Jul  7 19:31:06 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S26
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                5A:B3:37:FD:B8:9B:EE:10:45:90:97:72:A2:70:12:DD:D1:39:5F:CE
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: EB08D293792D3960AF4EE1449571EF064B6ECFB5033A932C4F4F634927A86A5C
    SPKI SHA256: CE34A114A60C55ED57A6107A5C37021603139191CA9785213886344302317DA3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S27

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S27
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 43A2FCD791C06840476AD73F2654D364E07E5B4F
- SHA-256: 5BAF3D78A35B7A9BD839C7AEEB1A5A92B225C620D824F7E537D7EDBCBA41EFAF
- SPKI SHA-256: 086F7344C9B40E1B0BCEB59468F6909877BF83401F446B96B6B8A2E0CC4BB750
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            43:a2:fc:d7:91:c0:68:40:47:6a:d7:3f:26:54:d3:64:e0:7e:5b:4f
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:31:12 2026 GMT
            Not After : Jul  7 19:31:12 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S27
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                C4:B9:B0:6C:27:6B:D7:67:16:79:01:E3:80:ED:C5:CF:C5:45:E0:5B
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5BAF3D78A35B7A9BD839C7AEEB1A5A92B225C620D824F7E537D7EDBCBA41EFAF
    SPKI SHA256: 086F7344C9B40E1B0BCEB59468F6909877BF83401F446B96B6B8A2E0CC4BB750
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S28

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S28
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 68AB97577FDA7151C4344614953AF9C88FD0AE6E
- SHA-256: 6B1AB876C341D7FBD6AB569CCFA86090DFADA1A16078F5D65834FDE3DEE1512F
- SPKI SHA-256: 0242A2B51CCEE3682EA3EAA32EE229FD97F6E29370B2D0CE33562C7063C84A08
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            68:ab:97:57:7f:da:71:51:c4:34:46:14:95:3a:f9:c8:8f:d0:ae:6e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:31:17 2026 GMT
            Not After : Jul  7 19:31:17 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S28
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                7D:53:BE:0A:26:56:69:B6:A8:B0:18:6E:23:91:F2:95:45:AA:D0:18
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 6B1AB876C341D7FBD6AB569CCFA86090DFADA1A16078F5D65834FDE3DEE1512F
    SPKI SHA256: 0242A2B51CCEE3682EA3EAA32EE229FD97F6E29370B2D0CE33562C7063C84A08
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon ECDSA 384 S29

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon ECDSA 384 S29
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Serial: 3FECE8CC13C5F09A70407C8EDC4136C11266CB7A
- SHA-256: 45F561F7C1AA5A9B97B697237F9408D2DF790522541A610DAA578764282D7CB7
- SPKI SHA-256: CD9704DA05848B41899FBC0D55FADFEF60A843BE33572C5C68F887CF2D6FC0B4
- Validity: 2026-07-08 to 2029-07-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- CRL DP: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3f:ec:e8:cc:13:c5:f0:9a:70:40:7c:8e:dc:41:36:c1:12:66:cb:7a
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 4
        Validity
            Not Before: Jul  8 19:31:22 2026 GMT
            Not After : Jul  7 19:31:22 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon ECDSA 384 S29
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                24:6F:B5:D2:7C:BE:42:43:AB:3A:03:0B:60:8D:50:6D:0C:EF:47:C1
            X509v3 Authority Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca4.amazontrust.com
                CA Issuers - URI:http://crt.rootca4.amazontrust.com/rootca4.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca4.amazontrust.com/rootca4.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 45F561F7C1AA5A9B97B697237F9408D2DF790522541A610DAA578764282D7CB7
    SPKI SHA256: CD9704DA05848B41899FBC0D55FADFEF60A843BE33572C5C68F887CF2D6FC0B4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca4.amazontrust.com
- AIA CA Issuers: http://crt.rootca4.amazontrust.com/rootca4.cer
- CRL Distribution Points: http://crl.rootca4.amazontrust.com/rootca4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon Root CA 1

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Issuer: countryName=US, stateOrProvinceName=Arizona, localityName=Scottsdale, organizationName=Starfield Technologies, Inc., commonName=Starfield Services Root Certificate Authority - G2
- Serial: 067B504AEF24EDA49E57F747484563F4E2A158
- SHA-256: 391220705B75BCF3ED3CD4B3631213F569D2CF8226101E170799A5354AB12861
- SPKI SHA-256: FBE3018031F9586BCBF41727E417B7D1C45C2F47F93BE372A17B96B50757D5A2
- Validity: 2015-10-21 to 2037-12-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.rootca1.amazontrust.com/rootca1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootg2.amazontrust.com
- CRL DP: http://crl.rootg2.amazontrust.com/rootg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:7b:50:4a:ef:24:ed:a4:9e:57:f7:47:48:45:63:f4:e2:a1:58
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2
        Validity
            Not Before: Oct 21 22:20:45 2015 GMT
            Not After : Dec 31 00:00:00 2037 GMT
        Subject: C = US, O = Amazon, CN = Amazon Root CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            X509v3 Authority Key Identifier:
                9C:5F:00:DF:AA:01:D7:30:2B:38:88:A2:B8:6D:4A:9C:F2:11:91:83
            Authority Information Access:
                OCSP - URI:http://ocsp.rootg2.amazontrust.com
                CA Issuers - URI:http://crl.rootg2.amazontrust.com/rootg2.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootg2.amazontrust.com/rootg2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 391220705B75BCF3ED3CD4B3631213F569D2CF8226101E170799A5354AB12861
    SPKI SHA256: FBE3018031F9586BCBF41727E417B7D1C45C2F47F93BE372A17B96B50757D5A2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.rootg2.amazontrust.com
- AIA CA Issuers: http://crl.rootg2.amazontrust.com/rootg2.cer
- CRL Distribution Points: http://crl.rootg2.amazontrust.com/rootg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon Root CA 1

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Issuer: countryName=US, stateOrProvinceName=Arizona, localityName=Scottsdale, organizationName=Starfield Technologies, Inc., commonName=Starfield Services Root Certificate Authority - G2
- Serial: 067F944A2A27CDF3FAC2AE2B01F908EEB9C4C6
- SHA-256: 87DCD4DC74640A322CD205552506D1BE64F12596258096544986B4850BC72706
- SPKI SHA-256: FBE3018031F9586BCBF41727E417B7D1C45C2F47F93BE372A17B96B50757D5A2
- Validity: 2015-05-25 to 2037-12-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.rootca1.amazontrust.com/rootca1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootg2.amazontrust.com
- CRL DP: http://crl.rootg2.amazontrust.com/rootg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:7f:94:4a:2a:27:cd:f3:fa:c2:ae:2b:01:f9:08:ee:b9:c4:c6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2
        Validity
            Not Before: May 25 12:00:00 2015 GMT
            Not After : Dec 31 01:00:00 2037 GMT
        Subject: C = US, O = Amazon, CN = Amazon Root CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            X509v3 Authority Key Identifier:
                9C:5F:00:DF:AA:01:D7:30:2B:38:88:A2:B8:6D:4A:9C:F2:11:91:83
            Authority Information Access:
                OCSP - URI:http://ocsp.rootg2.amazontrust.com
                CA Issuers - URI:http://crt.rootg2.amazontrust.com/rootg2.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootg2.amazontrust.com/rootg2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 87DCD4DC74640A322CD205552506D1BE64F12596258096544986B4850BC72706
    SPKI SHA256: FBE3018031F9586BCBF41727E417B7D1C45C2F47F93BE372A17B96B50757D5A2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.rootg2.amazontrust.com
- AIA CA Issuers: http://crt.rootg2.amazontrust.com/rootg2.cer
- CRL Distribution Points: http://crl.rootg2.amazontrust.com/rootg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon Root CA 2

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 2
- Issuer: countryName=US, stateOrProvinceName=Arizona, localityName=Scottsdale, organizationName=Starfield Technologies, Inc., commonName=Starfield Services Root Certificate Authority - G2
- Serial: 067F944A2F99539D505AEDF2DE3ED85701E6CA
- SHA-256: 8B358466D66126312120645A5875A6A57E3C81D98476A967604244254EAC00F0
- SPKI SHA-256: 7F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461
- Validity: 2015-05-25 to 2037-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.rootca2.amazontrust.com/rootca2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootg2.amazontrust.com
- CRL DP: http://crl.rootg2.amazontrust.com/rootg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:7f:94:4a:2f:99:53:9d:50:5a:ed:f2:de:3e:d8:57:01:e6:ca
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2
        Validity
            Not Before: May 25 12:00:00 2015 GMT
            Not After : Dec 31 01:00:00 2037 GMT
        Subject: C = US, O = Amazon, CN = Amazon Root CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B0:0C:F0:4C:30:F4:05:58:02:48:FD:33:E5:52:AF:4B:84:E3:66:52
            X509v3 Authority Key Identifier:
                9C:5F:00:DF:AA:01:D7:30:2B:38:88:A2:B8:6D:4A:9C:F2:11:91:83
            Authority Information Access:
                OCSP - URI:http://ocsp.rootg2.amazontrust.com
                CA Issuers - URI:http://crt.rootg2.amazontrust.com/rootg2.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootg2.amazontrust.com/rootg2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8B358466D66126312120645A5875A6A57E3C81D98476A967604244254EAC00F0
    SPKI SHA256: 7F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.rootg2.amazontrust.com
- AIA CA Issuers: http://crt.rootg2.amazontrust.com/rootg2.cer
- CRL Distribution Points: http://crl.rootg2.amazontrust.com/rootg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon Root CA 3

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 3
- Issuer: countryName=US, stateOrProvinceName=Arizona, localityName=Scottsdale, organizationName=Starfield Technologies, Inc., commonName=Starfield Services Root Certificate Authority - G2
- Serial: 067F944A30CFCC4F74B5F5306E54D3B7BE0AC3
- SHA-256: 40C826FDB22BA32A2F9DB4F94770F72B8B1DA9C8FFDA7B11E6F27AF245C89B5E
- SPKI SHA-256: 36ABC32656ACFC645C61B71613C4BF21C787F5CABBEE48348D58597803D7ABC9
- Validity: 2015-05-25 to 2037-12-31
- Key: EC 256 prime256v1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.rootca3.amazontrust.com/rootca3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootg2.amazontrust.com
- CRL DP: http://crl.rootg2.amazontrust.com/rootg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:7f:94:4a:30:cf:cc:4f:74:b5:f5:30:6e:54:d3:b7:be:0a:c3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2
        Validity
            Not Before: May 25 12:00:00 2015 GMT
            Not After : Dec 31 01:00:00 2037 GMT
        Subject: C = US, O = Amazon, CN = Amazon Root CA 3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                AB:B6:DB:D7:06:9E:37:AC:30:86:07:91:70:C7:9C:C4:19:B1:78:C0
            X509v3 Authority Key Identifier:
                9C:5F:00:DF:AA:01:D7:30:2B:38:88:A2:B8:6D:4A:9C:F2:11:91:83
            Authority Information Access:
                OCSP - URI:http://ocsp.rootg2.amazontrust.com
                CA Issuers - URI:http://crt.rootg2.amazontrust.com/rootg2.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootg2.amazontrust.com/rootg2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 40C826FDB22BA32A2F9DB4F94770F72B8B1DA9C8FFDA7B11E6F27AF245C89B5E
    SPKI SHA256: 36ABC32656ACFC645C61B71613C4BF21C787F5CABBEE48348D58597803D7ABC9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.rootg2.amazontrust.com
- AIA CA Issuers: http://crt.rootg2.amazontrust.com/rootg2.cer
- CRL Distribution Points: http://crl.rootg2.amazontrust.com/rootg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon Root CA 4

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 4
- Issuer: countryName=US, stateOrProvinceName=Arizona, localityName=Scottsdale, organizationName=Starfield Technologies, Inc., commonName=Starfield Services Root Certificate Authority - G2
- Serial: 067F944A7111AAC3EA73BA4CAC07572696DF8B
- SHA-256: 543D9B7FC2A6471CD84FCA52C2CF6159DF83EBFCD88D8B08B5AF3F88737F52E6
- SPKI SHA-256: F7ECDED5C66047D28ED6466B543C40E0743ABE81D109254DCF845D4C2C7853C5
- Validity: 2015-05-25 to 2037-12-31
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.rootca4.amazontrust.com/rootca4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootg2.amazontrust.com
- CRL DP: http://crl.rootg2.amazontrust.com/rootg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:7f:94:4a:71:11:aa:c3:ea:73:ba:4c:ac:07:57:26:96:df:8b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2
        Validity
            Not Before: May 25 12:00:00 2015 GMT
            Not After : Dec 31 01:00:00 2037 GMT
        Subject: C = US, O = Amazon, CN = Amazon Root CA 4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D3:EC:C7:3A:65:6E:CC:E1:DA:76:9A:56:FB:9C:F3:86:6D:57:E5:81
            X509v3 Authority Key Identifier:
                9C:5F:00:DF:AA:01:D7:30:2B:38:88:A2:B8:6D:4A:9C:F2:11:91:83
            Authority Information Access:
                OCSP - URI:http://ocsp.rootg2.amazontrust.com
                CA Issuers - URI:http://crt.rootg2.amazontrust.com/rootg2.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootg2.amazontrust.com/rootg2.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 543D9B7FC2A6471CD84FCA52C2CF6159DF83EBFCD88D8B08B5AF3F88737F52E6
    SPKI SHA256: F7ECDED5C66047D28ED6466B543C40E0743ABE81D109254DCF845D4C2C7853C5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.rootg2.amazontrust.com
- AIA CA Issuers: http://crt.rootg2.amazontrust.com/rootg2.cer
- CRL Distribution Points: http://crl.rootg2.amazontrust.com/rootg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 EU M01

- Subject: countryName=DE, organizationName=Amazon, commonName=Amazon RSA 2048 EU M01
- Issuer: countryName=DE, organizationName=Amazon, commonName=Amazon RSA 2048 Root EU M1
- Serial: 07C0CD7F8F15941719BFE146C57861C071B88B
- SHA-256: 738618D9D4C34F9DFF95720255EF9040FFC7C4C5203309438E10E6F4959462B6
- SPKI SHA-256: 6C1627C2FAB4D0D500ABD71EF86C5B785D8E6DC356E217B2127F7FF5EDF97DCB
- Validity: 2024-11-14 to 2032-11-14
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ffc2cba4-ab1a-4f7b-af96-9607dd7cae98, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7bc93007-2ea2-47a4-909f-56b015703934, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=88d88042-b82d-4307-97f3-5ee151aeadfa, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=73520ed1-f83f-48be-9cb6-2831ed6cbb30, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1391d859-d8b4-4c2d-bb91-20f22fcca71d, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2aa980c4-f5fb-4bfb-9da1-a006eaf4c611
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.r2m01.eu.amazontrust.com/r2m01eu.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://eur2m1.ocsp.root.eu.amazontrust.com
- CRL DP: http://eur2m1.crl.root.eu.amazontrust.com/eur2m1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:c0:cd:7f:8f:15:94:17:19:bf:e1:46:c5:78:61:c0:71:b8:8b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = Amazon, CN = Amazon RSA 2048 Root EU M1
        Validity
            Not Before: Nov 14 12:47:35 2024 GMT
            Not After : Nov 14 12:47:35 2032 GMT
        Subject: C = DE, O = Amazon, CN = Amazon RSA 2048 EU M01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                31:D2:3E:BB:7B:29:C2:D3:3B:34:C0:23:34:1B:F1:43:5D:43:8E:B9
            X509v3 Authority Key Identifier:
                28:31:04:AC:48:7C:49:E8:50:23:44:3D:7F:CC:D5:35:02:73:0A:89
            Authority Information Access:
                OCSP - URI:http://eur2m1.ocsp.root.eu.amazontrust.com
                CA Issuers - URI:http://eur2m1.crt.root.eu.amazontrust.com/eur2m1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://eur2m1.crl.root.eu.amazontrust.com/eur2m1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 738618D9D4C34F9DFF95720255EF9040FFC7C4C5203309438E10E6F4959462B6
    SPKI SHA256: 6C1627C2FAB4D0D500ABD71EF86C5B785D8E6DC356E217B2127F7FF5EDF97DCB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://eur2m1.ocsp.root.eu.amazontrust.com
- AIA CA Issuers: http://eur2m1.crt.root.eu.amazontrust.com/eur2m1.crt
- CRL Distribution Points: http://eur2m1.crl.root.eu.amazontrust.com/eur2m1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 EU S00

- Subject: Amazon RSA 2048 EU S00
- Issuer: Amazon RSA 2048 Root EU M1
- Serial: -
- SHA-256: 2CE3BE72BBF56EDB17095B603ED4D8280B081B38204341546802C1427BB2435F
- SPKI SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
- Validity: 2025-10-01 to 2033-09-29
- Key: unknown
- Signature Algorithm: -

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-01.r1.ica.amznts.eu/r2s00/107e5d4b-cdc1-4c9c-b3a1-c0df09761f3e.crl, http://crl-01.r1.ica.amznts.eu/r2s00/95hypGNG1fN.crl, http://crl-01.r1.ica.amznts.eu/r2s00/fJYI9VHuQH.crl, http://crl-01.r1.ica.amznts.eu/r2s00/1hczOiLmz6y.crl, http://crl-01.r1.ica.amznts.eu/r2s00/5rYo6wJrdju.crl, http://crl-01.r1.ica.amznts.eu/r2s00/IageIZdwZWx.crl, http://crl-01.r1.ica.amznts.eu/r2s00/3BiZbXcF72l.crl, http://crl-01.r1.ica.amznts.eu/r2s00/9jBffI25DcW.crl, http://crl-01.r1.ica.amznts.eu/r2s00/Br4IWYzy1Fj.crl, http://crl-01.r1.ica.amznts.eu/r2s00/LiAwJ4vLj04.crl, http://crl-01.r1.ica.amznts.eu/r2s00/1qaWS9dl7Td.crl, http://crl-01.r1.ica.amznts.eu/r2s00/5Wv9GLm3G8Q.crl, http://crl-01.r1.ica.amznts.eu/r2s00/6GDp30PZUqz.crl, http://crl-01.r1.ica.amznts.eu/r2s00/E2X1lhfJJHn.crl, http://crl-01.r1.ica.amznts.eu/r2s00/GUMyrS5z6NC.crl, http://crl-01.r1.ica.amznts.eu/r2s00/6AIys3WJE16.crl, http://crl-01.r1.ica.amznts.eu/r2s00/7i27TXyVzho.crl, http://crl-01.r1.ica.amznts.eu/r2s00/8mq1W7tcAVu.crl, http://crl-01.r1.ica.amznts.eu/r2s00/FGIXpI3peI0.crl, http://crl-01.r1.ica.amznts.eu/r2s00/GyoG10RKFmX.crl, http://crl-01.r1.ica.amznts.eu/r2s00/4MxBXxzyx4E.crl, http://crl-01.r1.ica.amznts.eu/r2s00/9GTwSPJPwJh.crl, http://crl-01.r1.ica.amznts.eu/r2s00/9ih142KQSXk.crl, http://crl-01.r1.ica.amznts.eu/r2s00/5dx3cervDWq.crl, http://crl-01.r1.ica.amznts.eu/r2s00/73M45FD77YS.crl, http://crl-01.r1.ica.amznts.eu/r2s00/3FkbFTXGdj9.crl, http://crl-01.r1.ica.amznts.eu/r2s00/Fu7KUTCQKHw.crl, http://crl-01.r1.ica.amznts.eu/r2s00/HJF6eT7e2nL.crl, http://crl-01.r1.ica.amznts.eu/r2s00/1kvxBVJVQg6.crl, http://crl-01.r1.ica.amznts.eu/r2s00/3TIo2LloM79.crl, http://crl-01.r1.ica.amznts.eu/r2s00/4McmwkjkxOd.crl, http://crl-01.r1.ica.amznts.eu/r2s00/4RV80uGjy6Y.crl, http://crl-01.r1.ica.amznts.eu/r2s00/52rRaPc5XSp.crl, http://crl-01.r1.ica.amznts.eu/r2s00/5f5VDuLl0BH.crl, http://crl-01.r1.ica.amznts.eu/r2s00/6QAZ7xxNGbK.crl, http://crl-01.r1.ica.amznts.eu/r2s00/7E9M3dRDbjb.crl, http://crl-01.r1.ica.amznts.eu/r2s00/7oyvJm4oIMC.crl, http://crl-01.r1.ica.amznts.eu/r2s00/7qKZSWTuRwX.crl, http://crl-01.r1.ica.amznts.eu/r2s00/86j1wo4sUXg.crl, http://crl-01.r1.ica.amznts.eu/r2s00/A3VOgDiDALN.crl, http://crl-01.r1.ica.amznts.eu/r2s00/APZgihOizrp.crl, http://crl-01.r1.ica.amznts.eu/r2s00/EaR1sJdmKJc.crl, http://crl-01.r1.ica.amznts.eu/r2s00/GAM8xBz8T2m.crl, http://crl-01.r1.ica.amznts.eu/r2s00/2OAIUI8KOPN.crl, http://crl-01.r1.ica.amznts.eu/r2s00/50TliV7skOD.crl, http://crl-01.r1.ica.amznts.eu/r2s00/5HI8NWuWN9g.crl, http://crl-01.r1.ica.amznts.eu/r2s00/5sDRgiDZiiD.crl, http://crl-01.r1.ica.amznts.eu/r2s00/7E6LgPiYVbs.crl, http://crl-01.r1.ica.amznts.eu/r2s00/7yUl3hmJ8KV.crl, http://crl-01.r1.ica.amznts.eu/r2s00/8AGpkpacR96.crl, http://crl-01.r1.ica.amznts.eu/r2s00/8hglkTcuoE6.crl, http://crl-01.r1.ica.amznts.eu/r2s00/9j8fZmmrRDk.crl, http://crl-01.r1.ica.amznts.eu/r2s00/9tdm5caT6Fd.crl, http://crl-01.r1.ica.amznts.eu/r2s00/BzVL6zxuk9G.crl, http://crl-01.r1.ica.amznts.eu/r2s00/CyDVDbMyJed.crl, http://crl-01.r1.ica.amznts.eu/r2s00/DgJleDObsbi.crl, http://crl-01.r1.ica.amznts.eu/r2s00/FSrYpChDTQq.crl, http://crl-01.r1.ica.amznts.eu/r2s00/G6GciWtMJZ1.crl, http://crl-01.r1.ica.amznts.eu/r2s00/GAQYvXE5Ihf.crl, http://crl-01.r1.ica.amznts.eu/r2s00/GI94NCVc9Uz.crl, http://crl-01.r1.ica.amznts.eu/r2s00/HxC9wZ5jkEZ.crl, http://crl-01.r1.ica.amznts.eu/r2s00/IiKNdFL15Sr.crl, http://crl-01.r1.ica.amznts.eu/r2s00/KrF91Drneic.crl, http://crl-01.r1.ica.amznts.eu/r2s00/Kzs9iKGrIv3.crl, http://crl-01.r1.ica.amznts.eu/r2s00/L7rdnuc7ytO.crl, http://crl-01.r1.ica.amznts.eu/r2s00/Lp9kixnoBYm.crl, http://crl-01.r1.ica.amznts.eu/r2s00/1V0jjrBCKcN.crl, http://crl-01.r1.ica.amznts.eu/r2s00/1ikt4Kn0sQy.crl, http://crl-01.r1.ica.amznts.eu/r2s00/7UrHaE6RC01.crl, http://crl-01.r1.ica.amznts.eu/r2s00/AfEWNUQjK3W.crl, http://crl-01.r1.ica.amznts.eu/r2s00/CwUkbfEyWLk.crl, http://crl-01.r1.ica.amznts.eu/r2s00/ECz7VCXf7P3.crl, http://crl-01.r1.ica.amznts.eu/r2s00/IJMaeozIQpy.crl, http://crl-01.r1.ica.amznts.eu/r2s00/JdsGKBvFYSm.crl, http://crl-01.r1.ica.amznts.eu/r2s00/JtPjgTqQ868.crl, http://crl-01.r1.ica.amznts.eu/r2s00/9B9e9iiTPBR.crl, http://crl-01.r1.ica.amznts.eu/r2s00/FHKCgLcpfKh.crl, http://crl-01.r1.ica.amznts.eu/r2s00/G9EnhyD4mY2.crl, http://crl-01.r1.ica.amznts.eu/r2s00/GtXB078Bs5Q.crl, http://crl-01.r1.ica.amznts.eu/r2s00/2iq7iGqJEqe.crl, http://crl-01.r1.ica.amznts.eu/r2s00/31W8XHAzsIK.crl, http://crl-01.r1.ica.amznts.eu/r2s00/4QH3rdqRRRS.crl, http://crl-01.r1.ica.amznts.eu/r2s00/7smzASeMTYB.crl, http://crl-01.r1.ica.amznts.eu/r2s00/7uFi0qyLuHq.crl, http://crl-01.r1.ica.amznts.eu/r2s00/1SMJXHULxWt.crl, http://crl-01.r1.ica.amznts.eu/r2s00/3R5t2tXz2jx.crl, http://crl-01.r1.ica.amznts.eu/r2s00/8r0hYx11oRA.crl, http://crl-01.r1.ica.amznts.eu/r2s00/CBdtcnzMnyF.crl, http://crl-01.r1.ica.amznts.eu/r2s00/FB7xyBQEGY6.crl, http://crl-01.r1.ica.amznts.eu/r2s00/BLVMlLiKpp5.crl, http://crl-01.r1.ica.amznts.eu/r2s00/CMmvil7jVMX.crl, http://crl-01.r1.ica.amznts.eu/r2s00/EfG5zd4NWAv.crl, http://crl-01.r1.ica.amznts.eu/r2s00/XOgOFcF7RA.crl, http://crl-01.r1.ica.amznts.eu/r2s00/K6hGYvy7BUC.crl, http://crl-01.r1.ica.amznts.eu/r2s00/2yVroDvpS3u.crl, http://crl-01.r1.ica.amznts.eu/r2s00/KrYYd9Z3ePL.crl, http://crl-01.r1.ica.amznts.eu/r2s00/9MT8D7Av79v.crl, http://crl-01.r1.ica.amznts.eu/r2s00/D6eBdSc24UM.crl, http://crl-01.r1.ica.amznts.eu/r2s00/8FagXdKnFLh.crl, http://crl-01.r1.ica.amznts.eu/r2s00/DUkHboEWXGh.crl, http://crl-01.r1.ica.amznts.eu/r2s00/HFmdqxoYTt4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: -
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
SHA256 Fingerprint: 2CE3BE72BBF56EDB17095B603ED4D8280B081B38204341546802C1427BB2435F
SPKI SHA256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
```

#### Extensions

- Basic Constraints: {"present":false,"critical":false,"ca":false,"path_len":null}
- Key Usage: -
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- is_ca

### Amazon RSA 2048 EU S01

- Subject: Amazon RSA 2048 EU S01
- Issuer: Amazon RSA 2048 Root EU M1
- Serial: -
- SHA-256: AD74711E36B04D405884502784E431B370056886F38E4B4CBC80DC3A70520E66
- SPKI SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
- Validity: 2025-10-01 to 2033-09-29
- Key: unknown
- Signature Algorithm: -

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-01.r1.ica.amznts.eu/r2s01/64837acf-b877-4873-bede-5ea3fbf77381.crl, http://crl-01.r1.ica.amznts.eu/r2s01/BwJA3WzLzz2.crl, http://crl-01.r1.ica.amznts.eu/r2s01/J0Gg8Cf25LR.crl, http://crl-01.r1.ica.amznts.eu/r2s01/3O6KdmDcfKo.crl, http://crl-01.r1.ica.amznts.eu/r2s01/3Yw0Rq013rT.crl, http://crl-01.r1.ica.amznts.eu/r2s01/5jWiEvYXOrH.crl, http://crl-01.r1.ica.amznts.eu/r2s01/7SlWWLoCPSc.crl, http://crl-01.r1.ica.amznts.eu/r2s01/Bm4dC9NrkwX.crl, http://crl-01.r1.ica.amznts.eu/r2s01/BwPQrCj1wU3.crl, http://crl-01.r1.ica.amznts.eu/r2s01/CidPo0ZTWd7.crl, http://crl-01.r1.ica.amznts.eu/r2s01/Cw97rg9odkI.crl, http://crl-01.r1.ica.amznts.eu/r2s01/FbVU3uCZlSW.crl, http://crl-01.r1.ica.amznts.eu/r2s01/5cD9a5wJSYO.crl, http://crl-01.r1.ica.amznts.eu/r2s01/B9beVznrCX4.crl, http://crl-01.r1.ica.amznts.eu/r2s01/8wlmgAJglrj.crl, http://crl-01.r1.ica.amznts.eu/r2s01/94ff8WGOI3U.crl, http://crl-01.r1.ica.amznts.eu/r2s01/9o3859WQ01G.crl, http://crl-01.r1.ica.amznts.eu/r2s01/CMu2wkhoANy.crl, http://crl-01.r1.ica.amznts.eu/r2s01/JAbF72hdBRZ.crl, http://crl-01.r1.ica.amznts.eu/r2s01/JIy3h8Zv1oq.crl, http://crl-01.r1.ica.amznts.eu/r2s01/CxqtBguDAR.crl, http://crl-01.r1.ica.amznts.eu/r2s01/EWipaKvEcgN.crl, http://crl-01.r1.ica.amznts.eu/r2s01/8RArrmcTEDn.crl, http://crl-01.r1.ica.amznts.eu/r2s01/ATWUulSoFxg.crl, http://crl-01.r1.ica.amznts.eu/r2s01/9ogxRfUOTs1.crl, http://crl-01.r1.ica.amznts.eu/r2s01/En9Vtl0ykC.crl, http://crl-01.r1.ica.amznts.eu/r2s01/JHlPmqyLS0m.crl, http://crl-01.r1.ica.amznts.eu/r2s01/Li1JzDtdibe.crl, http://crl-01.r1.ica.amznts.eu/r2s01/2uhwpieasaX.crl, http://crl-01.r1.ica.amznts.eu/r2s01/4NzfnHXt3Xm.crl, http://crl-01.r1.ica.amznts.eu/r2s01/4W7g8NqeiLj.crl, http://crl-01.r1.ica.amznts.eu/r2s01/6tYkkQ3zOLU.crl, http://crl-01.r1.ica.amznts.eu/r2s01/DYP1vXdZrEh.crl, http://crl-01.r1.ica.amznts.eu/r2s01/H6plgQceVYb.crl, http://crl-01.r1.ica.amznts.eu/r2s01/Klh3WSSGSgf.crl, http://crl-01.r1.ica.amznts.eu/r2s01/LgG7NVQu6ep.crl, http://crl-01.r1.ica.amznts.eu/r2s01/1jYdG0GVQWs.crl, http://crl-01.r1.ica.amznts.eu/r2s01/24QeVYapKE3.crl, http://crl-01.r1.ica.amznts.eu/r2s01/36cGLjRL9em.crl, http://crl-01.r1.ica.amznts.eu/r2s01/3uegMJbdJ5B.crl, http://crl-01.r1.ica.amznts.eu/r2s01/5Or4zaIpzQW.crl, http://crl-01.r1.ica.amznts.eu/r2s01/669cu13Hwa2.crl, http://crl-01.r1.ica.amznts.eu/r2s01/6BlK1JWrVkj.crl, http://crl-01.r1.ica.amznts.eu/r2s01/9RXmV6LpoE0.crl, http://crl-01.r1.ica.amznts.eu/r2s01/9jYxcbeWAvx.crl, http://crl-01.r1.ica.amznts.eu/r2s01/ACJPf34J8ke.crl, http://crl-01.r1.ica.amznts.eu/r2s01/AHe2ofYBSy4.crl, http://crl-01.r1.ica.amznts.eu/r2s01/ANxNz012tjh.crl, http://crl-01.r1.ica.amznts.eu/r2s01/B3zmArd1xix.crl, http://crl-01.r1.ica.amznts.eu/r2s01/B4abbb2EQXu.crl, http://crl-01.r1.ica.amznts.eu/r2s01/D0sOhHwzAcX.crl, http://crl-01.r1.ica.amznts.eu/r2s01/FJbhUSHyONt.crl, http://crl-01.r1.ica.amznts.eu/r2s01/I4LXCyh0kI7.crl, http://crl-01.r1.ica.amznts.eu/r2s01/ISeVzyws6vf.crl, http://crl-01.r1.ica.amznts.eu/r2s01/ImkiJihM8LD.crl, http://crl-01.r1.ica.amznts.eu/r2s01/KMZXe52SJfs.crl, http://crl-01.r1.ica.amznts.eu/r2s01/LCwkdTZXMCS.crl, http://crl-01.r1.ica.amznts.eu/r2s01/LPRcb1Vcc8H.crl, http://crl-01.r1.ica.amznts.eu/r2s01/o5QyeSgQGE.crl, http://crl-01.r1.ica.amznts.eu/r2s01/30cpcSt8ulN.crl, http://crl-01.r1.ica.amznts.eu/r2s01/3BbBRWGOpg9.crl, http://crl-01.r1.ica.amznts.eu/r2s01/3mBKJ0BHJu9.crl, http://crl-01.r1.ica.amznts.eu/r2s01/40T3BLqLZCs.crl, http://crl-01.r1.ica.amznts.eu/r2s01/49nb7xnjdve.crl, http://crl-01.r1.ica.amznts.eu/r2s01/50pMxbeowaI.crl, http://crl-01.r1.ica.amznts.eu/r2s01/6NSxhpbJv62.crl, http://crl-01.r1.ica.amznts.eu/r2s01/7EHm34H0q7d.crl, http://crl-01.r1.ica.amznts.eu/r2s01/97BdqG9Ipb1.crl, http://crl-01.r1.ica.amznts.eu/r2s01/BUNQH7DZ89s.crl, http://crl-01.r1.ica.amznts.eu/r2s01/BawoNvQJfQQ.crl, http://crl-01.r1.ica.amznts.eu/r2s01/BkG1FLdhZbk.crl, http://crl-01.r1.ica.amznts.eu/r2s01/IvdQzA0k34m.crl, http://crl-01.r1.ica.amznts.eu/r2s01/Kdevvn0lDbH.crl, http://crl-01.r1.ica.amznts.eu/r2s01/1cNE7z5EAqA.crl, http://crl-01.r1.ica.amznts.eu/r2s01/4ge3hBhJrtK.crl, http://crl-01.r1.ica.amznts.eu/r2s01/B7hbyTXwrGc.crl, http://crl-01.r1.ica.amznts.eu/r2s01/BdvWdeJUTUS.crl, http://crl-01.r1.ica.amznts.eu/r2s01/DAoMUOqVvDJ.crl, http://crl-01.r1.ica.amznts.eu/r2s01/GbCF3ZkZ2Y6.crl, http://crl-01.r1.ica.amznts.eu/r2s01/H1DSoFfIEnW.crl, http://crl-01.r1.ica.amznts.eu/r2s01/LF3SBL7Tgjr.crl, http://crl-01.r1.ica.amznts.eu/r2s01/LtELLqtfJiS.crl, http://crl-01.r1.ica.amznts.eu/r2s01/1f1dvc0rZyp.crl, http://crl-01.r1.ica.amznts.eu/r2s01/2VFxKaWFLk9.crl, http://crl-01.r1.ica.amznts.eu/r2s01/55225MI2P94.crl, http://crl-01.r1.ica.amznts.eu/r2s01/AxtThIIjYV5.crl, http://crl-01.r1.ica.amznts.eu/r2s01/EtOxyMiysMQ.crl, http://crl-01.r1.ica.amznts.eu/r2s01/FAKPw4M5HOZ.crl, http://crl-01.r1.ica.amznts.eu/r2s01/C004aX8mMAC.crl, http://crl-01.r1.ica.amznts.eu/r2s01/DKEsyD1BdxT.crl, http://crl-01.r1.ica.amznts.eu/r2s01/GEDyyHghnuk.crl, http://crl-01.r1.ica.amznts.eu/r2s01/LFQhXwtXNJV.crl, http://crl-01.r1.ica.amznts.eu/r2s01/35cco1VcT1v.crl, http://crl-01.r1.ica.amznts.eu/r2s01/4iK9XfkEQpM.crl, http://crl-01.r1.ica.amznts.eu/r2s01/7K395WMPmts.crl, http://crl-01.r1.ica.amznts.eu/r2s01/7u6OXgvQjMK.crl, http://crl-01.r1.ica.amznts.eu/r2s01/Ka1fyrkPKtZ.crl, http://crl-01.r1.ica.amznts.eu/r2s01/3lWwBzeNA9o.crl, http://crl-01.r1.ica.amznts.eu/r2s01/AaJQxAw3qSh.crl, http://crl-01.r1.ica.amznts.eu/r2s01/5PnnylhvLAV.crl, http://crl-01.r1.ica.amznts.eu/r2s01/2Ialnh8fueU.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: -
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
SHA256 Fingerprint: AD74711E36B04D405884502784E431B370056886F38E4B4CBC80DC3A70520E66
SPKI SHA256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
```

#### Extensions

- Basic Constraints: {"present":false,"critical":false,"ca":false,"path_len":null}
- Key Usage: -
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- is_ca

### Amazon RSA 2048 EU S02

- Subject: Amazon RSA 2048 EU S02
- Issuer: Amazon RSA 2048 Root EU M1
- Serial: -
- SHA-256: D784A432804C2D537B9A826BB780A6362A9E02BBCBE2DDB8CFA011A0B70B3C37
- SPKI SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
- Validity: 2025-10-01 to 2033-09-29
- Key: unknown
- Signature Algorithm: -

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-01.r1.ica.amznts.eu/r2s02/1c700d1a-ad9a-472c-b170-d803422ff646.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: -
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
SHA256 Fingerprint: D784A432804C2D537B9A826BB780A6362A9E02BBCBE2DDB8CFA011A0B70B3C37
SPKI SHA256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
```

#### Extensions

- Basic Constraints: {"present":false,"critical":false,"ca":false,"path_len":null}
- Key Usage: -
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- is_ca

### Amazon RSA 2048 M01

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 M01
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 077312380B9D6688A33B1ED9BF9CCDA68E0E0F
- SHA-256: 5338EBEC8FB2AC60996126D3E76AA34FD0F3318AC78EBB7AC8F6F1361F484B33
- SPKI SHA-256: 0F11F8B6DE342FE79DB85EACCE963A4CE365C6166105DFA927DC1B1E54367EEC
- Validity: 2022-08-23 to 2030-08-23
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d960de8d-58e1-49cd-b021-b81d840df468, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2089114f-2403-404e-9861-bcfc60426e0f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf97e8d2-eb5b-4702-9635-a1e8fffb0903, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9260ceb-c627-473c-b934-7a2da4f8930b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b6f87753-9559-4ee9-a79a-517d669b7a9a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=69e3c555-0da9-4b06-a1c1-64756cddb5ac
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.r2m01.amazontrust.com/r2m01.crl, http://crl.r2m01.amazontrust.com/AmazonRSA2048M01.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:73:12:38:0b:9d:66:88:a3:3b:1e:d9:bf:9c:cd:a6:8e:0e:0f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Aug 23 22:21:28 2022 GMT
            Not After : Aug 23 22:21:28 2030 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 M01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                81:B8:0E:63:8A:89:12:18:E5:FA:3B:3B:50:95:9F:E6:E5:90:13:85
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5338EBEC8FB2AC60996126D3E76AA34FD0F3318AC78EBB7AC8F6F1361F484B33
    SPKI SHA256: 0F11F8B6DE342FE79DB85EACCE963A4CE365C6166105DFA927DC1B1E54367EEC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 M02

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 M02
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 0773124A4BCBD44EC7B53BEAF194842D3A0FA1
- SHA-256: B0F330A31A0C50987E1C3A7BB02C2DDA682991D3165B517BD44FBA4A6020BD94
- SPKI SHA-256: D7CB643F2AF69DC92FE1F828D1D84091A52D27686EDBCDF5C653B648A86AF1D8
- Validity: 2022-08-23 to 2030-08-23
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d960de8d-58e1-49cd-b021-b81d840df468, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2089114f-2403-404e-9861-bcfc60426e0f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf97e8d2-eb5b-4702-9635-a1e8fffb0903, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9260ceb-c627-473c-b934-7a2da4f8930b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b6f87753-9559-4ee9-a79a-517d669b7a9a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=69e3c555-0da9-4b06-a1c1-64756cddb5ac
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.r2m02.amazontrust.com/r2m02.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:73:12:4a:4b:cb:d4:4e:c7:b5:3b:ea:f1:94:84:2d:3a:0f:a1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Aug 23 22:25:30 2022 GMT
            Not After : Aug 23 22:25:30 2030 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 M02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                C0:31:52:CD:5A:50:C3:82:7C:74:71:CE:CB:E9:9C:F9:7A:EB:82:E2
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B0F330A31A0C50987E1C3A7BB02C2DDA682991D3165B517BD44FBA4A6020BD94
    SPKI SHA256: D7CB643F2AF69DC92FE1F828D1D84091A52D27686EDBCDF5C653B648A86AF1D8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 M03

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 M03
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 0773124CD406D267C0991CDD299A9F38317985
- SHA-256: BF8A69027BCC8D2D42A6E6D25BDD4873F6A34B8F90EDF07E86C5D6916DA0B933
- SPKI SHA-256: BF14689FF125E4AB88E2FC797B2D43826B189916349C37790A0E067C9F12F9B8
- Validity: 2022-08-23 to 2030-08-23
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d960de8d-58e1-49cd-b021-b81d840df468, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2089114f-2403-404e-9861-bcfc60426e0f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf97e8d2-eb5b-4702-9635-a1e8fffb0903, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9260ceb-c627-473c-b934-7a2da4f8930b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b6f87753-9559-4ee9-a79a-517d669b7a9a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=69e3c555-0da9-4b06-a1c1-64756cddb5ac
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.r2m03.amazontrust.com/r2m03.crl, http://crl.r2m03.amazontrust.com/AmazonRSA2048M03.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:73:12:4c:d4:06:d2:67:c0:99:1c:dd:29:9a:9f:38:31:79:85
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Aug 23 22:26:04 2022 GMT
            Not After : Aug 23 22:26:04 2030 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 M03
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                55:D9:18:5F:D2:1C:CC:01:E1:58:B4:BE:AB:D9:55:42:01:D7:2E:02
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BF8A69027BCC8D2D42A6E6D25BDD4873F6A34B8F90EDF07E86C5D6916DA0B933
    SPKI SHA256: BF14689FF125E4AB88E2FC797B2D43826B189916349C37790A0E067C9F12F9B8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 M04

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 M04
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 0773124F2A952E3ED18A58BDB85D1BC0CE5F27
- SHA-256: 138BDF6E23AC971EB4E626B279DD6A26F057510F1DE394293A5EEA2860DE019B
- SPKI SHA-256: 1BD2CD340AA5F3DEDE818B1A6DAB219335024C4264581CE0A04B64F17FFAEFC7
- Validity: 2022-08-23 to 2030-08-23
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d960de8d-58e1-49cd-b021-b81d840df468, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2089114f-2403-404e-9861-bcfc60426e0f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf97e8d2-eb5b-4702-9635-a1e8fffb0903, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9260ceb-c627-473c-b934-7a2da4f8930b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b6f87753-9559-4ee9-a79a-517d669b7a9a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=69e3c555-0da9-4b06-a1c1-64756cddb5ac
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.r2m04.amazontrust.com/r2m04.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:73:12:4f:2a:95:2e:3e:d1:8a:58:bd:b8:5d:1b:c0:ce:5f:27
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Aug 23 22:26:35 2022 GMT
            Not After : Aug 23 22:26:35 2030 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 M04
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                1F:52:92:61:56:82:54:7F:81:66:D8:1D:3D:0A:AA:32:5C:87:DD:08
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 138BDF6E23AC971EB4E626B279DD6A26F057510F1DE394293A5EEA2860DE019B
    SPKI SHA256: 1BD2CD340AA5F3DEDE818B1A6DAB219335024C4264581CE0A04B64F17FFAEFC7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 M05

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 M05
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 07C94234B1AD0904742883696FCF0FF9300D60
- SHA-256: F1D0D91BD33F9C0600B394481847FCD3069D4532FE55EFC06A12E5259DD4CE2A
- SPKI SHA-256: 3DD9C9093547E6322BB3BDABFE67D5A929A6FDE215FE7AE5C528A4797663BC8F
- Validity: 2025-01-13 to 2033-01-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-01.r1.ica.amazontrust.com/crl/6b68b79c-fc9c-4868-99c1-be752cf7a618.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:c9:42:34:b1:ad:09:04:74:28:83:69:6f:cf:0f:f9:30:0d:60
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Jan 13 23:50:41 2025 GMT
            Not After : Jan 13 23:50:41 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 M05
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                37:89:F6:3C:1A:07:48:A3:25:8F:B8:5F:0B:38:2C:65:0F:F4:5B:1E
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F1D0D91BD33F9C0600B394481847FCD3069D4532FE55EFC06A12E5259DD4CE2A
    SPKI SHA256: 3DD9C9093547E6322BB3BDABFE67D5A929A6FDE215FE7AE5C528A4797663BC8F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 M06

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 M06
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 07C94234B1AFE5CF6DB09889B70D1A25C9BDF7
- SHA-256: 64F0C9594F65BD69FCF82E35879827F3AEB36B9F9977726A9A9F33CB61EE7BBB
- SPKI SHA-256: 1822A8DD53E117B25D340A18602BC2D4E6B8BB0227CEDA9933BA15DCDAB889B2
- Validity: 2025-01-13 to 2033-01-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-01.r1.ica.amazontrust.com/crl/c3d508ce-1fe1-46da-96d7-328b1e24148a.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:c9:42:34:b1:af:e5:cf:6d:b0:98:89:b7:0d:1a:25:c9:bd:f7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Jan 13 23:52:30 2025 GMT
            Not After : Jan 13 23:52:30 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 M06
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                0F:CD:5C:24:55:06:51:9C:E0:0F:B8:DC:BC:D1:F9:8C:CD:2E:8D:23
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 64F0C9594F65BD69FCF82E35879827F3AEB36B9F9977726A9A9F33CB61EE7BBB
    SPKI SHA256: 1822A8DD53E117B25D340A18602BC2D4E6B8BB0227CEDA9933BA15DCDAB889B2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 Root EU M1

- Subject: countryName=DE, organizationName=Amazon, commonName=Amazon RSA 2048 Root EU M1
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 2C262FA9BECF62144017E421AF1765F339FED23B
- SHA-256: BDDB011E995A62B9F58507944E04F8A624888EF4C0C41C79CAB032168C86B83B
- SPKI SHA-256: 8D935558E6A3C896330148FFDF6A1AC0A5BFBA1AB44545135A3B376C9A1A308D
- Validity: 2025-09-17 to 2033-09-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://eur2m1.crl.root.amznts.eu/eur2m1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2c:26:2f:a9:be:cf:62:14:40:17:e4:21:af:17:65:f3:39:fe:d2:3b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Sep 17 21:31:42 2025 GMT
            Not After : Sep 15 21:31:42 2033 GMT
        Subject: C = DE, O = Amazon, CN = Amazon RSA 2048 Root EU M1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                28:31:04:AC:48:7C:49:E8:50:23:44:3D:7F:CC:D5:35:02:73:0A:89
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BDDB011E995A62B9F58507944E04F8A624888EF4C0C41C79CAB032168C86B83B
    SPKI SHA256: 8D935558E6A3C896330148FFDF6A1AC0A5BFBA1AB44545135A3B376C9A1A308D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S00

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S00
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 07D683B2263EC182441AAF4F2B22EE821FC885
- SHA-256: B687B4900748F3D9890FE7BA81F035BDC07CCA578A47790DE8BFC02915124857
- SPKI SHA-256: E8ADBA38821F4E64A8D01C8F307E9A382487013B9E62B03926AEF6C7F5A2D140
- Validity: 2025-05-28 to 2033-05-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:d6:83:b2:26:3e:c1:82:44:1a:af:4f:2b:22:ee:82:1f:c8:85
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: May 28 17:28:36 2025 GMT
            Not After : May 28 17:28:36 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S00
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                C3:7F:C5:74:92:6D:70:B8:BD:97:96:56:38:A1:91:EA:45:7D:D8:72
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B687B4900748F3D9890FE7BA81F035BDC07CCA578A47790DE8BFC02915124857
    SPKI SHA256: E8ADBA38821F4E64A8D01C8F307E9A382487013B9E62B03926AEF6C7F5A2D140
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S01

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S01
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 07D683B226402B33527CACC5FB67556C55FC1A
- SHA-256: 62BBC1627CAB36CB87DEC27C74276D4E742C7ED513192950DA8244C9BC8EE58A
- SPKI SHA-256: 45EE712CE06E202487044F0C7A26EECB441A20B55D862CB946853F58A97405B4
- Validity: 2025-05-28 to 2033-05-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:d6:83:b2:26:40:2b:33:52:7c:ac:c5:fb:67:55:6c:55:fc:1a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: May 28 17:28:36 2025 GMT
            Not After : May 28 17:28:36 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                41:E2:DB:F8:D1:2B:E1:42:0B:4A:E7:64:F9:86:AB:21:E4:95:7C:C9
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 62BBC1627CAB36CB87DEC27C74276D4E742C7ED513192950DA8244C9BC8EE58A
    SPKI SHA256: 45EE712CE06E202487044F0C7A26EECB441A20B55D862CB946853F58A97405B4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S02

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S02
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 07D683B22640BC21261B5669772C1DE4CDDCF3
- SHA-256: C1951C4DED63B526FDCAC5AA28FCD9073CB8E00B57E18DE536F1CACA532A1B3A
- SPKI SHA-256: F21831D6A9CB809292531613D3C6DFA72243D9F08C8F52243FFA74EB2B9C7DBB
- Validity: 2025-05-28 to 2033-05-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:d6:83:b2:26:40:bc:21:26:1b:56:69:77:2c:1d:e4:cd:dc:f3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: May 28 17:28:37 2025 GMT
            Not After : May 28 17:28:37 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                20:71:6B:E8:87:EB:A4:FC:74:F0:97:4C:65:E5:8D:2B:6C:51:B2:BD
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C1951C4DED63B526FDCAC5AA28FCD9073CB8E00B57E18DE536F1CACA532A1B3A
    SPKI SHA256: F21831D6A9CB809292531613D3C6DFA72243D9F08C8F52243FFA74EB2B9C7DBB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S03

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S03
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 07D683B226413E3D7DCC7BEFB1D921E21F7D8C
- SHA-256: 63FA7725C0A65F03802A196175C3D793A313D9B3917CDBBBD4E54898F154D38E
- SPKI SHA-256: F18DB0FE82E282DF9BC3C80AC10394533A8BC267ACD13D4CB10ABBEDDBB60BD6
- Validity: 2025-05-28 to 2033-05-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:d6:83:b2:26:41:3e:3d:7d:cc:7b:ef:b1:d9:21:e2:1f:7d:8c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: May 28 17:28:38 2025 GMT
            Not After : May 28 17:28:38 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S03
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                A3:2F:56:04:5F:74:55:83:5A:88:5B:69:3B:C8:22:51:F8:41:47:CC
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 63FA7725C0A65F03802A196175C3D793A313D9B3917CDBBBD4E54898F154D38E
    SPKI SHA256: F18DB0FE82E282DF9BC3C80AC10394533A8BC267ACD13D4CB10ABBEDDBB60BD6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S04

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S04
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 07D683B22641C479871E33649A9CE5C8A0AB2A
- SHA-256: 94930D569EEAE4264CF70F69BD7FCD0FCFA5F1A76AD87AD1DBDBEE984E9321E6
- SPKI SHA-256: 67816844432145AFCB9521C6D617450EB0B519FC059A5A45F808054F73C88DAD
- Validity: 2025-05-28 to 2033-05-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:d6:83:b2:26:41:c4:79:87:1e:33:64:9a:9c:e5:c8:a0:ab:2a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: May 28 17:28:38 2025 GMT
            Not After : May 28 17:28:38 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S04
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                14:E1:B2:6F:E3:33:FA:29:7F:F9:2E:FC:D1:89:8A:82:A8:B0:E3:E2
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 94930D569EEAE4264CF70F69BD7FCD0FCFA5F1A76AD87AD1DBDBEE984E9321E6
    SPKI SHA256: 67816844432145AFCB9521C6D617450EB0B519FC059A5A45F808054F73C88DAD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S05

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S05
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 07D683B22642342F5A06AC1DC706ECB1B6F4F1
- SHA-256: 311554AFD476DEDEA5CAA0D6917F2B05EB12994EE8AD1617B4DAF98ED4CD57AE
- SPKI SHA-256: 43F19FC57567513C0E410F7BDA2B2DE37886AE751D316C363B7A04906403AD58
- Validity: 2025-05-28 to 2033-05-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:d6:83:b2:26:42:34:2f:5a:06:ac:1d:c7:06:ec:b1:b6:f4:f1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: May 28 17:28:39 2025 GMT
            Not After : May 28 17:28:39 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S05
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                0B:1D:49:6C:48:2E:A2:C3:E4:A8:A8:5C:69:74:38:C3:B4:23:61:5E
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 311554AFD476DEDEA5CAA0D6917F2B05EB12994EE8AD1617B4DAF98ED4CD57AE
    SPKI SHA256: 43F19FC57567513C0E410F7BDA2B2DE37886AE751D316C363B7A04906403AD58
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S06

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S06
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 7A788D3918A0D52F6955FEAED371737AB51E594A
- SHA-256: BA1987F4BB1612406C414FAD60AA69332B6ED0B96FC7A99F9F690B69D78E8766
- SPKI SHA-256: 318952A3ACEE98EC269FB113315AB6085A328C379CC685959D71BB811FB33F7F
- Validity: 2026-04-22 to 2029-04-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r1001.amazontrust.com/r2s06/d542be06-efcf-498e-b2d6-4fa2fa079934.crl, http://crl.r1001.amazontrust.com/r2s06/ACfv06hp1il.crl, http://crl.r1001.amazontrust.com/r2s06/2VNMCyZJF3w.crl, http://crl.r1001.amazontrust.com/r2s06/4UcKUihCXPx.crl, http://crl.r1001.amazontrust.com/r2s06/9dTUhBOyHPB.crl, http://crl.r1001.amazontrust.com/r2s06/EUKcAY8qjRn.crl, http://crl.r1001.amazontrust.com/r2s06/LvxFfw9AeYu.crl, http://crl.r1001.amazontrust.com/r2s06/10bS6zAGCSf.crl, http://crl.r1001.amazontrust.com/r2s06/3j2h0p84dfU.crl, http://crl.r1001.amazontrust.com/r2s06/4n46CQ5CnqO.crl, http://crl.r1001.amazontrust.com/r2s06/ALAoo1XewLE.crl, http://crl.r1001.amazontrust.com/r2s06/AXbo27IjhXj.crl, http://crl.r1001.amazontrust.com/r2s06/AxxNabVsewT.crl, http://crl.r1001.amazontrust.com/r2s06/BEVMLopGhUV.crl, http://crl.r1001.amazontrust.com/r2s06/BvLbEbuKRnr.crl, http://crl.r1001.amazontrust.com/r2s06/CUJZxvd7ai1.crl, http://crl.r1001.amazontrust.com/r2s06/DZTPIroGRyY.crl, http://crl.r1001.amazontrust.com/r2s06/GLK6uMqcClS.crl, http://crl.r1001.amazontrust.com/r2s06/JYXxEvIcTgD.crl, http://crl.r1001.amazontrust.com/r2s06/COiS9hNO24E.crl, http://crl.r1001.amazontrust.com/r2s06/KtgkVfZYg8h.crl, http://crl.r1001.amazontrust.com/r2s06/LxUzh0WiVp7.crl, http://crl.r1001.amazontrust.com/r2s06/1k01oA8nFjX.crl, http://crl.r1001.amazontrust.com/r2s06/23xn3dhN5s9.crl, http://crl.r1001.amazontrust.com/r2s06/2vG3zIncRlV.crl, http://crl.r1001.amazontrust.com/r2s06/5K47PbIByLB.crl, http://crl.r1001.amazontrust.com/r2s06/8EImFMM1eU8.crl, http://crl.r1001.amazontrust.com/r2s06/A6wt5REuFhO.crl, http://crl.r1001.amazontrust.com/r2s06/AK1yxzFKtmj.crl, http://crl.r1001.amazontrust.com/r2s06/BCtimU5jZBF.crl, http://crl.r1001.amazontrust.com/r2s06/CHPWGZL5HRD.crl, http://crl.r1001.amazontrust.com/r2s06/CQJ3r8AOoC6.crl, http://crl.r1001.amazontrust.com/r2s06/DCx79I43442.crl, http://crl.r1001.amazontrust.com/r2s06/FVc9p4q0WK4.crl, http://crl.r1001.amazontrust.com/r2s06/FZ1eQ3nObh3.crl, http://crl.r1001.amazontrust.com/r2s06/FdjKNGsie6x.crl, http://crl.r1001.amazontrust.com/r2s06/FhgcSoD9SI9.crl, http://crl.r1001.amazontrust.com/r2s06/GQy1b2mJ5sU.crl, http://crl.r1001.amazontrust.com/r2s06/HgbOv6iYR8h.crl, http://crl.r1001.amazontrust.com/r2s06/HtfBtCyZ3x2.crl, http://crl.r1001.amazontrust.com/r2s06/J2ULej2YiFR.crl, http://crl.r1001.amazontrust.com/r2s06/Jru63xi6nsQ.crl, http://crl.r1001.amazontrust.com/r2s06/TceGk6HhUW.crl, http://crl.r1001.amazontrust.com/r2s06/gdbnocANbn.crl, http://crl.r1001.amazontrust.com/r2s06/3OTwxfSAPmk.crl, http://crl.r1001.amazontrust.com/r2s06/4GOJnRtTeq7.crl, http://crl.r1001.amazontrust.com/r2s06/6wIY2ii5WsF.crl, http://crl.r1001.amazontrust.com/r2s06/B21jZm3S1V1.crl, http://crl.r1001.amazontrust.com/r2s06/BsQQhmN3zCP.crl, http://crl.r1001.amazontrust.com/r2s06/EGkKf7DElFm.crl, http://crl.r1001.amazontrust.com/r2s06/FMc0b3jkzTM.crl, http://crl.r1001.amazontrust.com/r2s06/GKdfUuOf3nZ.crl, http://crl.r1001.amazontrust.com/r2s06/GMlUZL4YcMv.crl, http://crl.r1001.amazontrust.com/r2s06/HVPOXmfyJuA.crl, http://crl.r1001.amazontrust.com/r2s06/HmsGLqcVfxM.crl, http://crl.r1001.amazontrust.com/r2s06/6vvpG3qqNl2.crl, http://crl.r1001.amazontrust.com/r2s06/BuJZVe4FDIq.crl, http://crl.r1001.amazontrust.com/r2s06/DsgddJZyrSd.crl, http://crl.r1001.amazontrust.com/r2s06/FGk5B0iR4Mi.crl, http://crl.r1001.amazontrust.com/r2s06/FQqDnLIVBui.crl, http://crl.r1001.amazontrust.com/r2s06/7jO918wWzV5.crl, http://crl.r1001.amazontrust.com/r2s06/CEyJUPBfeDM.crl, http://crl.r1001.amazontrust.com/r2s06/DCm1wR2jFhF.crl, http://crl.r1001.amazontrust.com/r2s06/J9rnSM2eYnk.crl, http://crl.r1001.amazontrust.com/r2s06/1AFYDkSuwpk.crl, http://crl.r1001.amazontrust.com/r2s06/1i0JBnOLghp.crl, http://crl.r1001.amazontrust.com/r2s06/5dv75fiOZBF.crl, http://crl.r1001.amazontrust.com/r2s06/FDLfG8QUylV.crl, http://crl.r1001.amazontrust.com/r2s06/KKplIEX33QW.crl, http://crl.r1001.amazontrust.com/r2s06/1Oo3qSZWTN3.crl, http://crl.r1001.amazontrust.com/r2s06/1SEvkcfZPMp.crl, http://crl.r1001.amazontrust.com/r2s06/1r4whiXmR3y.crl, http://crl.r1001.amazontrust.com/r2s06/6IiLrralC2G.crl, http://crl.r1001.amazontrust.com/r2s06/D6OTLok1PQz.crl, http://crl.r1001.amazontrust.com/r2s06/GIVIDbkVwW.crl, http://crl.r1001.amazontrust.com/r2s06/JmHZzJKbjgg.crl, http://crl.r1001.amazontrust.com/r2s06/KdMsa15HpMZ.crl, http://crl.r1001.amazontrust.com/r2s06/Lwb8jVNfGC9.crl, http://crl.r1001.amazontrust.com/r2s06/6YMfh8IIzN5.crl, http://crl.r1001.amazontrust.com/r2s06/9LX8ll6QfCB.crl, http://crl.r1001.amazontrust.com/r2s06/CjAlCQ2FFST.crl, http://crl.r1001.amazontrust.com/r2s06/3poV61i8FTM.crl, http://crl.r1001.amazontrust.com/r2s06/4LebqTS0Zmg.crl, http://crl.r1001.amazontrust.com/r2s06/5xBdlq50Etg.crl, http://crl.r1001.amazontrust.com/r2s06/GztjrGPRUtU.crl, http://crl.r1001.amazontrust.com/r2s06/Hqhw5iYpAAg.crl, http://crl.r1001.amazontrust.com/r2s06/D6IUx9osajb.crl, http://crl.r1001.amazontrust.com/r2s06/1BMlXKAjJaw.crl, http://crl.r1001.amazontrust.com/r2s06/3hkNEJ7yyBa.crl, http://crl.r1001.amazontrust.com/r2s06/BHzrzodZGYL.crl, http://crl.r1001.amazontrust.com/r2s06/BS4UstVtfEN.crl, http://crl.r1001.amazontrust.com/r2s06/7BkbAu8XogK.crl, http://crl.r1001.amazontrust.com/r2s06/Dg1idUpTVIi.crl, http://crl.r1001.amazontrust.com/r2s06/3ks4fIiRELZ.crl, http://crl.r1001.amazontrust.com/r2s06/68PXyLDKvA8.crl, http://crl.r1001.amazontrust.com/r2s06/BF2bZTQwebp.crl, http://crl.r1001.amazontrust.com/r2s06/1Xjw5pXn6jA.crl, http://crl.r1001.amazontrust.com/r2s06/A92j1o6BZYZ.crl, http://crl.r1001.amazontrust.com/r2s06/IFbwLjLT0FL.crl, http://crl.r1001.amazontrust.com/r2s06/4zWrkkHrZUO.crl, http://crl.r1001.amazontrust.com/r2s06/2jZqzPFF8Cq.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:78:8d:39:18:a0:d5:2f:69:55:fe:ae:d3:71:73:7a:b5:1e:59:4a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Apr 22 19:25:09 2026 GMT
            Not After : Apr 21 19:25:09 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S06
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                65:A4:09:5D:AE:C5:A5:86:1D:32:1D:F8:7D:4C:0B:7C:80:51:18:27
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BA1987F4BB1612406C414FAD60AA69332B6ED0B96FC7A99F9F690B69D78E8766
    SPKI SHA256: 318952A3ACEE98EC269FB113315AB6085A328C379CC685959D71BB811FB33F7F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S07

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S07
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 76D0215EA7561DE15CC2DEC5E287FE2547DC6633
- SHA-256: 2AB22EA330338D0DD1F4562DD52E352DD00331CF330507B9C76DD0603733812C
- SPKI SHA-256: A83CBFBC7EBCF5E03829507102F72B2E0084E1B7166DF79C3BC3A78B74357076
- Validity: 2026-04-22 to 2029-04-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r1001.amazontrust.com/r2s07/5ecb3be7-b64b-4cc2-b268-941cf80c7c55.crl, http://crl.r1001.amazontrust.com/r2s07/48ipoMdwAoY.crl, http://crl.r1001.amazontrust.com/r2s07/1OAa3LMg6Zg.crl, http://crl.r1001.amazontrust.com/r2s07/2IjAG77M82y.crl, http://crl.r1001.amazontrust.com/r2s07/2YG6m6jUGOy.crl, http://crl.r1001.amazontrust.com/r2s07/3Hokz7msZvK.crl, http://crl.r1001.amazontrust.com/r2s07/3o82atLTLPo.crl, http://crl.r1001.amazontrust.com/r2s07/4T5CrkFYO4G.crl, http://crl.r1001.amazontrust.com/r2s07/6XdxgptSUE7.crl, http://crl.r1001.amazontrust.com/r2s07/9Cbp9yQp9SN.crl, http://crl.r1001.amazontrust.com/r2s07/ATac6GwgHW2.crl, http://crl.r1001.amazontrust.com/r2s07/AgTodizuVvR.crl, http://crl.r1001.amazontrust.com/r2s07/Cg6mdUxpCYZ.crl, http://crl.r1001.amazontrust.com/r2s07/DBEB8ILmp97.crl, http://crl.r1001.amazontrust.com/r2s07/DCsn1eEYFz6.crl, http://crl.r1001.amazontrust.com/r2s07/DUVKRV4Z4w4.crl, http://crl.r1001.amazontrust.com/r2s07/DVlNMrw7rLh.crl, http://crl.r1001.amazontrust.com/r2s07/HmYqudkHsG5.crl, http://crl.r1001.amazontrust.com/r2s07/KXUTGPw9x1D.crl, http://crl.r1001.amazontrust.com/r2s07/02g6m5aY7GN.crl, http://crl.r1001.amazontrust.com/r2s07/2IYyhNDqukz.crl, http://crl.r1001.amazontrust.com/r2s07/3lPiov5R0fp.crl, http://crl.r1001.amazontrust.com/r2s07/3uzy4XUrSz1.crl, http://crl.r1001.amazontrust.com/r2s07/4L3ktyKQR4D.crl, http://crl.r1001.amazontrust.com/r2s07/4T1F784NOFF.crl, http://crl.r1001.amazontrust.com/r2s07/5IZoDD5ThIX.crl, http://crl.r1001.amazontrust.com/r2s07/5LqzlSBeI5p.crl, http://crl.r1001.amazontrust.com/r2s07/8KTCY0Noyc4.crl, http://crl.r1001.amazontrust.com/r2s07/8ZKsRz1j2q1.crl, http://crl.r1001.amazontrust.com/r2s07/8oYUYT0Yfn6.crl, http://crl.r1001.amazontrust.com/r2s07/9rONTNtDJ6r.crl, http://crl.r1001.amazontrust.com/r2s07/A5QNqEee0At.crl, http://crl.r1001.amazontrust.com/r2s07/CRUYHq5xOYd.crl, http://crl.r1001.amazontrust.com/r2s07/CbM5Khb8eGH.crl, http://crl.r1001.amazontrust.com/r2s07/CxRE1t7Kpiq.crl, http://crl.r1001.amazontrust.com/r2s07/Djh8DP6XSYa.crl, http://crl.r1001.amazontrust.com/r2s07/FKUcG32QUSM.crl, http://crl.r1001.amazontrust.com/r2s07/GwVqMuclc2.crl, http://crl.r1001.amazontrust.com/r2s07/GzMa7KH6l8A.crl, http://crl.r1001.amazontrust.com/r2s07/JPTCdadHtwo.crl, http://crl.r1001.amazontrust.com/r2s07/JqsdVUYi9OL.crl, http://crl.r1001.amazontrust.com/r2s07/JwdNqx5hSPt.crl, http://crl.r1001.amazontrust.com/r2s07/gt0MtK63kW.crl, http://crl.r1001.amazontrust.com/r2s07/lqmMRGUPgJ.crl, http://crl.r1001.amazontrust.com/r2s07/10NmVLdBgkC.crl, http://crl.r1001.amazontrust.com/r2s07/8zKZ0iGiPgl.crl, http://crl.r1001.amazontrust.com/r2s07/ALmWEw7tfeG.crl, http://crl.r1001.amazontrust.com/r2s07/D0dEkvMWna5.crl, http://crl.r1001.amazontrust.com/r2s07/Dil1m1Wavo7.crl, http://crl.r1001.amazontrust.com/r2s07/LuzXwOagyuR.crl, http://crl.r1001.amazontrust.com/r2s07/WU3jGek7Hq.crl, http://crl.r1001.amazontrust.com/r2s07/4CpwOVTNniz.crl, http://crl.r1001.amazontrust.com/r2s07/88kECFP7LUZ.crl, http://crl.r1001.amazontrust.com/r2s07/9QMPCRsgSRt.crl, http://crl.r1001.amazontrust.com/r2s07/9bZUrfiWERa.crl, http://crl.r1001.amazontrust.com/r2s07/FIdnvlWXnHE.crl, http://crl.r1001.amazontrust.com/r2s07/KapLvuzqYD7.crl, http://crl.r1001.amazontrust.com/r2s07/2g2JSBZAbyB.crl, http://crl.r1001.amazontrust.com/r2s07/5pcW9YAyQZW.crl, http://crl.r1001.amazontrust.com/r2s07/63jX6HIhvZr.crl, http://crl.r1001.amazontrust.com/r2s07/A2vGUjducoe.crl, http://crl.r1001.amazontrust.com/r2s07/BqS7fb6yxa9.crl, http://crl.r1001.amazontrust.com/r2s07/CY6VzhpxlIE.crl, http://crl.r1001.amazontrust.com/r2s07/HtK5Ew9mWbv.crl, http://crl.r1001.amazontrust.com/r2s07/IlevQlZdWiq.crl, http://crl.r1001.amazontrust.com/r2s07/IyWUXsjsM0m.crl, http://crl.r1001.amazontrust.com/r2s07/LIXvp3vcGoN.crl, http://crl.r1001.amazontrust.com/r2s07/1pMg8g87OFO.crl, http://crl.r1001.amazontrust.com/r2s07/B3cpvupU5wV.crl, http://crl.r1001.amazontrust.com/r2s07/LWjBICoWnc0.crl, http://crl.r1001.amazontrust.com/r2s07/LfzVrv25PDJ.crl, http://crl.r1001.amazontrust.com/r2s07/89wCvdU2vc5.crl, http://crl.r1001.amazontrust.com/r2s07/8oolvjSdUWO.crl, http://crl.r1001.amazontrust.com/r2s07/8rnC8HpAVwM.crl, http://crl.r1001.amazontrust.com/r2s07/B12ego4Zz3t.crl, http://crl.r1001.amazontrust.com/r2s07/BUNTICKvwYe.crl, http://crl.r1001.amazontrust.com/r2s07/1loDDZ4U2ce.crl, http://crl.r1001.amazontrust.com/r2s07/5KuhYtWL5Ad.crl, http://crl.r1001.amazontrust.com/r2s07/5u4iRiqzMC6.crl, http://crl.r1001.amazontrust.com/r2s07/6CaqPcd6huT.crl, http://crl.r1001.amazontrust.com/r2s07/6fLtcMBgSk0.crl, http://crl.r1001.amazontrust.com/r2s07/9tflWJLro3n.crl, http://crl.r1001.amazontrust.com/r2s07/HshmkXdkr6a.crl, http://crl.r1001.amazontrust.com/r2s07/KnGkN6x1IO0.crl, http://crl.r1001.amazontrust.com/r2s07/LMA1RpI43LB.crl, http://crl.r1001.amazontrust.com/r2s07/H3PdjfQ2KQN.crl, http://crl.r1001.amazontrust.com/r2s07/8mpNWzKJitW.crl, http://crl.r1001.amazontrust.com/r2s07/AwAtIEQgn3L.crl, http://crl.r1001.amazontrust.com/r2s07/2pRnLLFJQYU.crl, http://crl.r1001.amazontrust.com/r2s07/4IscgaYyhP7.crl, http://crl.r1001.amazontrust.com/r2s07/HPxDxnQhCqz.crl, http://crl.r1001.amazontrust.com/r2s07/BRw7ow9OeTg.crl, http://crl.r1001.amazontrust.com/r2s07/ELrb5iXAFAf.crl, http://crl.r1001.amazontrust.com/r2s07/7NdvqXotasH.crl, http://crl.r1001.amazontrust.com/r2s07/DaBBFBLb117.crl, http://crl.r1001.amazontrust.com/r2s07/mxu4akpSLW.crl, http://crl.r1001.amazontrust.com/r2s07/DzaaULuw8Wb.crl, http://crl.r1001.amazontrust.com/r2s07/L71LX2rZHoZ.crl, http://crl.r1001.amazontrust.com/r2s07/83Eg6WhoyaU.crl, http://crl.r1001.amazontrust.com/r2s07/ZskSWCXBGr.crl, http://crl.r1001.amazontrust.com/r2s07/E9K41FNEiDW.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:d0:21:5e:a7:56:1d:e1:5c:c2:de:c5:e2:87:fe:25:47:dc:66:33
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Apr 22 19:25:15 2026 GMT
            Not After : Apr 21 19:25:15 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S07
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                60:49:66:15:D8:F9:9A:A7:F4:80:84:6E:D0:E2:40:12:40:91:35:49
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2AB22EA330338D0DD1F4562DD52E352DD00331CF330507B9C76DD0603733812C
    SPKI SHA256: A83CBFBC7EBCF5E03829507102F72B2E0084E1B7166DF79C3BC3A78B74357076
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S08

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S08
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 5461557E010A15911F0D0645429E7257CAE9FEA2
- SHA-256: 62E81C6805A0A23A1F946171DF0423B4A427399E0947A516918EE96F11F984CC
- SPKI SHA-256: 46B913B42D463E3BB6A33B0EA114CDECD8DD3EBFF6EFA5E85A5D06ACE3E092E8
- Validity: 2026-04-22 to 2029-04-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r1001.amazontrust.com/r2s08/2d6f5013-459d-4fb2-ad0d-35c49acff419.crl, http://crl.r1001.amazontrust.com/r2s08/7OW46NFSQD2.crl, http://crl.r1001.amazontrust.com/r2s08/Ghs6GEWFIdQ.crl, http://crl.r1001.amazontrust.com/r2s08/02nkcVS7HgK.crl, http://crl.r1001.amazontrust.com/r2s08/3WDwIEGZQCq.crl, http://crl.r1001.amazontrust.com/r2s08/3hFsUR2Wac3.crl, http://crl.r1001.amazontrust.com/r2s08/5N2U1D8i5Ja.crl, http://crl.r1001.amazontrust.com/r2s08/5ai01DOxKCQ.crl, http://crl.r1001.amazontrust.com/r2s08/5pWV8gr6aEU.crl, http://crl.r1001.amazontrust.com/r2s08/7HxNHmxBuHR.crl, http://crl.r1001.amazontrust.com/r2s08/7OcPUNyaQMc.crl, http://crl.r1001.amazontrust.com/r2s08/ATTjZEew0nc.crl, http://crl.r1001.amazontrust.com/r2s08/DPiFyCqjuh2.crl, http://crl.r1001.amazontrust.com/r2s08/ETWZVanCXfH.crl, http://crl.r1001.amazontrust.com/r2s08/Fb2AaAmdJq6.crl, http://crl.r1001.amazontrust.com/r2s08/G3QB0ZnShpQ.crl, http://crl.r1001.amazontrust.com/r2s08/Hpnk6EZAsW0.crl, http://crl.r1001.amazontrust.com/r2s08/IRjb7DQ2MeB.crl, http://crl.r1001.amazontrust.com/r2s08/IfMBy2vNTZj.crl, http://crl.r1001.amazontrust.com/r2s08/KRtwbzIPjXI.crl, http://crl.r1001.amazontrust.com/r2s08/LhjXWqVrqJ8.crl, http://crl.r1001.amazontrust.com/r2s08/2HCAvelWzKf.crl, http://crl.r1001.amazontrust.com/r2s08/3p0FTMF34VZ.crl, http://crl.r1001.amazontrust.com/r2s08/6U4c18f8QBL.crl, http://crl.r1001.amazontrust.com/r2s08/8XuHjWfAR6h.crl, http://crl.r1001.amazontrust.com/r2s08/B2QV07r6T6c.crl, http://crl.r1001.amazontrust.com/r2s08/C4mnpI9w1FK.crl, http://crl.r1001.amazontrust.com/r2s08/C6YEe3GfuT1.crl, http://crl.r1001.amazontrust.com/r2s08/EA4VumXO4Eg.crl, http://crl.r1001.amazontrust.com/r2s08/FqgJfeXXX1S.crl, http://crl.r1001.amazontrust.com/r2s08/GMr2Xh0Wiv5.crl, http://crl.r1001.amazontrust.com/r2s08/I0Krxutbhui.crl, http://crl.r1001.amazontrust.com/r2s08/IQ2A0oLOQiX.crl, http://crl.r1001.amazontrust.com/r2s08/Ih4dEkQNoIg.crl, http://crl.r1001.amazontrust.com/r2s08/J1Flk2rxLJP.crl, http://crl.r1001.amazontrust.com/r2s08/JTGbi1V2Ani.crl, http://crl.r1001.amazontrust.com/r2s08/hxCMoVoNUn.crl, http://crl.r1001.amazontrust.com/r2s08/1RYEgOf0uRF.crl, http://crl.r1001.amazontrust.com/r2s08/1gKB8t9iuvT.crl, http://crl.r1001.amazontrust.com/r2s08/2U6ztNQEKfM.crl, http://crl.r1001.amazontrust.com/r2s08/3PvFchGMYuw.crl, http://crl.r1001.amazontrust.com/r2s08/3jeFAkrAvTA.crl, http://crl.r1001.amazontrust.com/r2s08/4PxO9cvPHlW.crl, http://crl.r1001.amazontrust.com/r2s08/5xArit0WYoG.crl, http://crl.r1001.amazontrust.com/r2s08/68zRwJoK4Ra.crl, http://crl.r1001.amazontrust.com/r2s08/6IaV3eDZj1o.crl, http://crl.r1001.amazontrust.com/r2s08/7H87bXmYxNk.crl, http://crl.r1001.amazontrust.com/r2s08/9M7ZF8qjQ6c.crl, http://crl.r1001.amazontrust.com/r2s08/BwJSfCA6Kof.crl, http://crl.r1001.amazontrust.com/r2s08/CNLp9dzxlOu.crl, http://crl.r1001.amazontrust.com/r2s08/EH3XWHrVIDH.crl, http://crl.r1001.amazontrust.com/r2s08/ETyPnNdqdZd.crl, http://crl.r1001.amazontrust.com/r2s08/HZF5pgJJZZv.crl, http://crl.r1001.amazontrust.com/r2s08/IZT2acvS30v.crl, http://crl.r1001.amazontrust.com/r2s08/IrX8ruWDqwJ.crl, http://crl.r1001.amazontrust.com/r2s08/XFeJWAWAQR.crl, http://crl.r1001.amazontrust.com/r2s08/1SFvx0J3OLg.crl, http://crl.r1001.amazontrust.com/r2s08/613lGQO2ODV.crl, http://crl.r1001.amazontrust.com/r2s08/8uWOkBVZcSQ.crl, http://crl.r1001.amazontrust.com/r2s08/9bwpLcgerAK.crl, http://crl.r1001.amazontrust.com/r2s08/HhkmF0fiHpK.crl, http://crl.r1001.amazontrust.com/r2s08/2Cb7vf3lsJL.crl, http://crl.r1001.amazontrust.com/r2s08/2VkUUSQ5KeM.crl, http://crl.r1001.amazontrust.com/r2s08/G4c99rfNNkx.crl, http://crl.r1001.amazontrust.com/r2s08/IuWkYct4E8G.crl, http://crl.r1001.amazontrust.com/r2s08/i6uVKbZCHP.crl, http://crl.r1001.amazontrust.com/r2s08/AupY0X2FR2E.crl, http://crl.r1001.amazontrust.com/r2s08/EY0s8EFhCfJ.crl, http://crl.r1001.amazontrust.com/r2s08/KWWs6bqud5R.crl, http://crl.r1001.amazontrust.com/r2s08/4ftBLKGpT6G.crl, http://crl.r1001.amazontrust.com/r2s08/HNnAT5rfFh1.crl, http://crl.r1001.amazontrust.com/r2s08/LRrnbfPHPC2.crl, http://crl.r1001.amazontrust.com/r2s08/3HlEFReNgTa.crl, http://crl.r1001.amazontrust.com/r2s08/BnGJg6swcxn.crl, http://crl.r1001.amazontrust.com/r2s08/4odvPpHboMn.crl, http://crl.r1001.amazontrust.com/r2s08/5hipvb8NpFm.crl, http://crl.r1001.amazontrust.com/r2s08/9j0V7mF9YvH.crl, http://crl.r1001.amazontrust.com/r2s08/Dhp6AIUuRAm.crl, http://crl.r1001.amazontrust.com/r2s08/1MGn61jIlUP.crl, http://crl.r1001.amazontrust.com/r2s08/6QaD5GKM67f.crl, http://crl.r1001.amazontrust.com/r2s08/6miKTbGgudt.crl, http://crl.r1001.amazontrust.com/r2s08/20UhNHb18Mz.crl, http://crl.r1001.amazontrust.com/r2s08/6Y2dQPCTuGz.crl, http://crl.r1001.amazontrust.com/r2s08/7LeTjlXiVp8.crl, http://crl.r1001.amazontrust.com/r2s08/6OXgwKmSFXG.crl, http://crl.r1001.amazontrust.com/r2s08/IhtyJ8nzM64.crl, http://crl.r1001.amazontrust.com/r2s08/KY3DO0EYqyx.crl, http://crl.r1001.amazontrust.com/r2s08/9Z3EJqTljoM.crl, http://crl.r1001.amazontrust.com/r2s08/D1RUqAetFN6.crl, http://crl.r1001.amazontrust.com/r2s08/FMm1rKLmr84.crl, http://crl.r1001.amazontrust.com/r2s08/3vOinau9PjZ.crl, http://crl.r1001.amazontrust.com/r2s08/JQdpy3o6Dzu.crl, http://crl.r1001.amazontrust.com/r2s08/KanGPb6hYy5.crl, http://crl.r1001.amazontrust.com/r2s08/DKjEZ7E3wZX.crl, http://crl.r1001.amazontrust.com/r2s08/JCGtpOATFVf.crl, http://crl.r1001.amazontrust.com/r2s08/IDgB88cUOlT.crl, http://crl.r1001.amazontrust.com/r2s08/IwTqmRZVC7g.crl, http://crl.r1001.amazontrust.com/r2s08/JtxTIYxH5L6.crl, http://crl.r1001.amazontrust.com/r2s08/E3udTXNyv93.crl, http://crl.r1001.amazontrust.com/r2s08/9CdGPHxBtkZ.crl, http://crl.r1001.amazontrust.com/r2s08/AKJOkD0DTn7.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            54:61:55:7e:01:0a:15:91:1f:0d:06:45:42:9e:72:57:ca:e9:fe:a2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Apr 22 19:25:20 2026 GMT
            Not After : Apr 21 19:25:20 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S08
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                B9:45:A2:70:E2:99:DC:11:95:BD:52:62:EA:43:42:4C:F0:2D:61:2B
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 62E81C6805A0A23A1F946171DF0423B4A427399E0947A516918EE96F11F984CC
    SPKI SHA256: 46B913B42D463E3BB6A33B0EA114CDECD8DD3EBFF6EFA5E85A5D06ACE3E092E8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S09

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S09
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 73650BDD1AE8D5FF6F6A256EB6AF79D7D93D5194
- SHA-256: E5A09008CF8BF271E25FEA61127B9F4F2E4AAA4102CB59AD5EDEBC3A0FB8F4AB
- SPKI SHA-256: B7116EEDD0864BF0E55DC33D9F4F7941864CD8376F47C005CAA72DB55AD7A305
- Validity: 2026-04-22 to 2029-04-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r2001.amazontrust.com/r2s09/708da32e-638c-450d-823a-a201f72fad8b.crl, http://crl.r2001.amazontrust.com/r2s09/DKDJFWBpoW2.crl, http://crl.r2001.amazontrust.com/r2s09/4c4t4LIMUxb.crl, http://crl.r2001.amazontrust.com/r2s09/10yzroQjC1I.crl, http://crl.r2001.amazontrust.com/r2s09/36VlgBjswsO.crl, http://crl.r2001.amazontrust.com/r2s09/3WTIc3jI7hk.crl, http://crl.r2001.amazontrust.com/r2s09/3dcMtFWrauZ.crl, http://crl.r2001.amazontrust.com/r2s09/3zFAJUza8D3.crl, http://crl.r2001.amazontrust.com/r2s09/6ohvLantPUo.crl, http://crl.r2001.amazontrust.com/r2s09/7OLmFikKRvo.crl, http://crl.r2001.amazontrust.com/r2s09/7Q8l7ZStqu2.crl, http://crl.r2001.amazontrust.com/r2s09/7c5kdXVV4Q4.crl, http://crl.r2001.amazontrust.com/r2s09/7cQP14U51R8.crl, http://crl.r2001.amazontrust.com/r2s09/9v9J8VujV3G.crl, http://crl.r2001.amazontrust.com/r2s09/Agc67YbFeUi.crl, http://crl.r2001.amazontrust.com/r2s09/AnaNCX1AFlK.crl, http://crl.r2001.amazontrust.com/r2s09/D8hHLTZtys7.crl, http://crl.r2001.amazontrust.com/r2s09/EgTGOzJVnFr.crl, http://crl.r2001.amazontrust.com/r2s09/EyKCdzXT3Tn.crl, http://crl.r2001.amazontrust.com/r2s09/FQ2RGGX3RH7.crl, http://crl.r2001.amazontrust.com/r2s09/GrRHc8gXBOx.crl, http://crl.r2001.amazontrust.com/r2s09/HDBTiPhWr2M.crl, http://crl.r2001.amazontrust.com/r2s09/HROrElmE7Dy.crl, http://crl.r2001.amazontrust.com/r2s09/JCa5WKJFkts.crl, http://crl.r2001.amazontrust.com/r2s09/K9F0N9g4cqg.crl, http://crl.r2001.amazontrust.com/r2s09/Kq9sFAiIarh.crl, http://crl.r2001.amazontrust.com/r2s09/R5nsDLC9Td.crl, http://crl.r2001.amazontrust.com/r2s09/10aMakdTzvT.crl, http://crl.r2001.amazontrust.com/r2s09/21kQUoSdlwN.crl, http://crl.r2001.amazontrust.com/r2s09/7rYjcWWICAe.crl, http://crl.r2001.amazontrust.com/r2s09/CCZOaaAMXxf.crl, http://crl.r2001.amazontrust.com/r2s09/EfgbPLr9M5U.crl, http://crl.r2001.amazontrust.com/r2s09/30PfEmOWlxo.crl, http://crl.r2001.amazontrust.com/r2s09/GNSHqZUPlcX.crl, http://crl.r2001.amazontrust.com/r2s09/Kb2Rboqh7hH.crl, http://crl.r2001.amazontrust.com/r2s09/tVfHmR7kfi.crl, http://crl.r2001.amazontrust.com/r2s09/3DhiVcN4Yh6.crl, http://crl.r2001.amazontrust.com/r2s09/5xRHdANCOjx.crl, http://crl.r2001.amazontrust.com/r2s09/8jBIOPxNxlb.crl, http://crl.r2001.amazontrust.com/r2s09/AO8dHZb2NPx.crl, http://crl.r2001.amazontrust.com/r2s09/Ax9qVGBaMqn.crl, http://crl.r2001.amazontrust.com/r2s09/IlAl473h5vH.crl, http://crl.r2001.amazontrust.com/r2s09/KNrQqYLP77Q.crl, http://crl.r2001.amazontrust.com/r2s09/erNJeQTHWG.crl, http://crl.r2001.amazontrust.com/r2s09/G6cho5LvRY6.crl, http://crl.r2001.amazontrust.com/r2s09/Hw6Qb4XyyoF.crl, http://crl.r2001.amazontrust.com/r2s09/3IGaAH9nVqA.crl, http://crl.r2001.amazontrust.com/r2s09/LYyewjQ25Gw.crl, http://crl.r2001.amazontrust.com/r2s09/2nHA6KbzYpB.crl, http://crl.r2001.amazontrust.com/r2s09/5Qcy8MMRigi.crl, http://crl.r2001.amazontrust.com/r2s09/60aCz0yqeVi.crl, http://crl.r2001.amazontrust.com/r2s09/7xo5xL4wIYX.crl, http://crl.r2001.amazontrust.com/r2s09/9Nxbj2uQVYw.crl, http://crl.r2001.amazontrust.com/r2s09/AW2h8Hnm8oL.crl, http://crl.r2001.amazontrust.com/r2s09/EG3MHQuTHGE.crl, http://crl.r2001.amazontrust.com/r2s09/GBIg5AAerS3.crl, http://crl.r2001.amazontrust.com/r2s09/Gg5SqSYlo5S.crl, http://crl.r2001.amazontrust.com/r2s09/10JtlVaepQe.crl, http://crl.r2001.amazontrust.com/r2s09/3dkEKloVzFO.crl, http://crl.r2001.amazontrust.com/r2s09/9xtbz8rJJ9p.crl, http://crl.r2001.amazontrust.com/r2s09/2fV4LsLOxDB.crl, http://crl.r2001.amazontrust.com/r2s09/4ZkwI1QDCVm.crl, http://crl.r2001.amazontrust.com/r2s09/AUZ9Z8oHdsj.crl, http://crl.r2001.amazontrust.com/r2s09/D4PQavo8iFI.crl, http://crl.r2001.amazontrust.com/r2s09/2YY2Jr1z5lp.crl, http://crl.r2001.amazontrust.com/r2s09/9U1RomlLhzZ.crl, http://crl.r2001.amazontrust.com/r2s09/A39QVa6m89b.crl, http://crl.r2001.amazontrust.com/r2s09/4H1PvuuF5YS.crl, http://crl.r2001.amazontrust.com/r2s09/D8LnWyJlFy8.crl, http://crl.r2001.amazontrust.com/r2s09/G3VPl7ruZOt.crl, http://crl.r2001.amazontrust.com/r2s09/02HyGaWjmhD.crl, http://crl.r2001.amazontrust.com/r2s09/BbzzJNJEEjK.crl, http://crl.r2001.amazontrust.com/r2s09/Fpu9qWYpjjK.crl, http://crl.r2001.amazontrust.com/r2s09/aKgsTpXYGQ.crl, http://crl.r2001.amazontrust.com/r2s09/9O5NigFi3Ec.crl, http://crl.r2001.amazontrust.com/r2s09/DE68IkUgrns.crl, http://crl.r2001.amazontrust.com/r2s09/EQjqA1JpbjD.crl, http://crl.r2001.amazontrust.com/r2s09/ET2KpzFY04G.crl, http://crl.r2001.amazontrust.com/r2s09/KstYabQepYZ.crl, http://crl.r2001.amazontrust.com/r2s09/8ZEQTHyclwh.crl, http://crl.r2001.amazontrust.com/r2s09/2050WiO5wqq.crl, http://crl.r2001.amazontrust.com/r2s09/2kmTFtFm9mE.crl, http://crl.r2001.amazontrust.com/r2s09/3RhTHL4zbVH.crl, http://crl.r2001.amazontrust.com/r2s09/4NHEPMWbNH8.crl, http://crl.r2001.amazontrust.com/r2s09/1dX301YPgSx.crl, http://crl.r2001.amazontrust.com/r2s09/6fbWw00lZgB.crl, http://crl.r2001.amazontrust.com/r2s09/CNYEpxymSCk.crl, http://crl.r2001.amazontrust.com/r2s09/H2XDhV25Qn8.crl, http://crl.r2001.amazontrust.com/r2s09/A0jp7sPtqHD.crl, http://crl.r2001.amazontrust.com/r2s09/G6b0HK1CtwU.crl, http://crl.r2001.amazontrust.com/r2s09/KriDJdg40xX.crl, http://crl.r2001.amazontrust.com/r2s09/7a3oeYxGXsG.crl, http://crl.r2001.amazontrust.com/r2s09/7YMV4binsUH.crl, http://crl.r2001.amazontrust.com/r2s09/8r7E3sTXUlF.crl, http://crl.r2001.amazontrust.com/r2s09/GI0Z44EbRrk.crl, http://crl.r2001.amazontrust.com/r2s09/H4xnUfYJhsX.crl, http://crl.r2001.amazontrust.com/r2s09/IqpZeMYqvIw.crl, http://crl.r2001.amazontrust.com/r2s09/AdXUPAAi1s1.crl, http://crl.r2001.amazontrust.com/r2s09/5ueic0FjRog.crl, http://crl.r2001.amazontrust.com/r2s09/LfFlbtFtxvf.crl, http://crl.r2001.amazontrust.com/r2s09/KX6PXkhMG4r.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            73:65:0b:dd:1a:e8:d5:ff:6f:6a:25:6e:b6:af:79:d7:d9:3d:51:94
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Apr 22 19:25:25 2026 GMT
            Not After : Apr 21 19:25:25 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S09
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                3D:97:B6:A6:AF:C7:84:AC:EE:23:F2:90:D9:14:0A:AC:3C:4A:F0:53
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E5A09008CF8BF271E25FEA61127B9F4F2E4AAA4102CB59AD5EDEBC3A0FB8F4AB
    SPKI SHA256: B7116EEDD0864BF0E55DC33D9F4F7941864CD8376F47C005CAA72DB55AD7A305
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S10

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S10
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 6CA2F62E3F213CADE2F32A1C7B76768D7471E4B0
- SHA-256: A38B75A1866AFFBDBD6FB6653214C09F13E3F3B3248E5B098FD6240A0B21F373
- SPKI SHA-256: A477C4564709BACECA036AF1D9BA1C4B8A0D7030C4DBF6574FB0158947FC8C18
- Validity: 2026-04-22 to 2029-04-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r2001.amazontrust.com/r2s10/c61fb2fd-9f30-4c65-be63-f7dcde85c2d1.crl, http://crl.r2001.amazontrust.com/r2s10/1KtkIuitnEq.crl, http://crl.r2001.amazontrust.com/r2s10/29TRk50xKFe.crl, http://crl.r2001.amazontrust.com/r2s10/2qXAWjjyvT7.crl, http://crl.r2001.amazontrust.com/r2s10/34dTcFUe3TC.crl, http://crl.r2001.amazontrust.com/r2s10/4glLKSbAUGf.crl, http://crl.r2001.amazontrust.com/r2s10/5GHTvbdwQUY.crl, http://crl.r2001.amazontrust.com/r2s10/69UhsNJ1VWm.crl, http://crl.r2001.amazontrust.com/r2s10/7DbPpRz232G.crl, http://crl.r2001.amazontrust.com/r2s10/7Px6BdNz46O.crl, http://crl.r2001.amazontrust.com/r2s10/7wCQ28fcN8m.crl, http://crl.r2001.amazontrust.com/r2s10/9vJ8I8Q7000.crl, http://crl.r2001.amazontrust.com/r2s10/C83aBiIVDcm.crl, http://crl.r2001.amazontrust.com/r2s10/ChVwEh8TxSb.crl, http://crl.r2001.amazontrust.com/r2s10/Dk8wCOALoSz.crl, http://crl.r2001.amazontrust.com/r2s10/Dm6pujvBnrS.crl, http://crl.r2001.amazontrust.com/r2s10/FOjWeEgnu0I.crl, http://crl.r2001.amazontrust.com/r2s10/FhnOlhBamhv.crl, http://crl.r2001.amazontrust.com/r2s10/G3847W5nTBY.crl, http://crl.r2001.amazontrust.com/r2s10/IRBQxzUlTD8.crl, http://crl.r2001.amazontrust.com/r2s10/QsfVJBZzSg.crl, http://crl.r2001.amazontrust.com/r2s10/3bWOnHeIrfv.crl, http://crl.r2001.amazontrust.com/r2s10/9OwQJXeYSdR.crl, http://crl.r2001.amazontrust.com/r2s10/FFCe3vTpe1L.crl, http://crl.r2001.amazontrust.com/r2s10/SHZh326hOu.crl, http://crl.r2001.amazontrust.com/r2s10/1d8sUuhnwAM.crl, http://crl.r2001.amazontrust.com/r2s10/1iLKtyINYfX.crl, http://crl.r2001.amazontrust.com/r2s10/2amVKzqGpRe.crl, http://crl.r2001.amazontrust.com/r2s10/93lQqF0McmD.crl, http://crl.r2001.amazontrust.com/r2s10/AI44VNgYZLS.crl, http://crl.r2001.amazontrust.com/r2s10/BgsslWXA5f1.crl, http://crl.r2001.amazontrust.com/r2s10/HnX5pawwJE4.crl, http://crl.r2001.amazontrust.com/r2s10/64qapjixSmO.crl, http://crl.r2001.amazontrust.com/r2s10/Aw4jQqDzujf.crl, http://crl.r2001.amazontrust.com/r2s10/CeGewTn9g35.crl, http://crl.r2001.amazontrust.com/r2s10/E4sJZ8DgR6V.crl, http://crl.r2001.amazontrust.com/r2s10/Gck16cN3V40.crl, http://crl.r2001.amazontrust.com/r2s10/H6lauSQodXP.crl, http://crl.r2001.amazontrust.com/r2s10/I7yVeGHJzqD.crl, http://crl.r2001.amazontrust.com/r2s10/DrfV2MWDSoD.crl, http://crl.r2001.amazontrust.com/r2s10/JvW2x6OEI1g.crl, http://crl.r2001.amazontrust.com/r2s10/4UG4jJOl4tB.crl, http://crl.r2001.amazontrust.com/r2s10/654mKUWnb0Z.crl, http://crl.r2001.amazontrust.com/r2s10/8rd3JsdXgKV.crl, http://crl.r2001.amazontrust.com/r2s10/DgrHNFKXb89.crl, http://crl.r2001.amazontrust.com/r2s10/FviHN1fMkSO.crl, http://crl.r2001.amazontrust.com/r2s10/2Z8sdkbdSyt.crl, http://crl.r2001.amazontrust.com/r2s10/4fLhb4DZvFV.crl, http://crl.r2001.amazontrust.com/r2s10/8nGie4WC0YN.crl, http://crl.r2001.amazontrust.com/r2s10/Ch0YZqlfITr.crl, http://crl.r2001.amazontrust.com/r2s10/KUf88rET4WO.crl, http://crl.r2001.amazontrust.com/r2s10/wnVMf2kevN.crl, http://crl.r2001.amazontrust.com/r2s10/550jjXCLyAd.crl, http://crl.r2001.amazontrust.com/r2s10/8dd6bVYTZox.crl, http://crl.r2001.amazontrust.com/r2s10/98kaLzrVYAg.crl, http://crl.r2001.amazontrust.com/r2s10/8SQYrLkI6XF.crl, http://crl.r2001.amazontrust.com/r2s10/Gtfnl36pnm9.crl, http://crl.r2001.amazontrust.com/r2s10/KOyC9XcbLlz.crl, http://crl.r2001.amazontrust.com/r2s10/jnkak5UbeO.crl, http://crl.r2001.amazontrust.com/r2s10/AUsLiqSPgIA.crl, http://crl.r2001.amazontrust.com/r2s10/EabRl67DW27.crl, http://crl.r2001.amazontrust.com/r2s10/3AjGIxC4kCS.crl, http://crl.r2001.amazontrust.com/r2s10/FDQKatfrv9Q.crl, http://crl.r2001.amazontrust.com/r2s10/GVhq1h7Gefl.crl, http://crl.r2001.amazontrust.com/r2s10/HKtCHdfGzpO.crl, http://crl.r2001.amazontrust.com/r2s10/7risZDgICoS.crl, http://crl.r2001.amazontrust.com/r2s10/A6XDphMXCt8.crl, http://crl.r2001.amazontrust.com/r2s10/CthstQnsVhJ.crl, http://crl.r2001.amazontrust.com/r2s10/JEPRFq1RoGk.crl, http://crl.r2001.amazontrust.com/r2s10/JsObHuJZlf7.crl, http://crl.r2001.amazontrust.com/r2s10/4MYcAylX067.crl, http://crl.r2001.amazontrust.com/r2s10/3OvDmt7a1ny.crl, http://crl.r2001.amazontrust.com/r2s10/5HvW2ekzGdv.crl, http://crl.r2001.amazontrust.com/r2s10/F2AKctJQG5p.crl, http://crl.r2001.amazontrust.com/r2s10/5OMTiN24LHe.crl, http://crl.r2001.amazontrust.com/r2s10/1W6vZR7S8dm.crl, http://crl.r2001.amazontrust.com/r2s10/FIRKjTIVuJ1.crl, http://crl.r2001.amazontrust.com/r2s10/8OG4Y5lQ7gu.crl, http://crl.r2001.amazontrust.com/r2s10/9flFzovYrQD.crl, http://crl.r2001.amazontrust.com/r2s10/ApdsEHEsZ5r.crl, http://crl.r2001.amazontrust.com/r2s10/ENyEIVqFlhd.crl, http://crl.r2001.amazontrust.com/r2s10/Ipha8c3bxT8.crl, http://crl.r2001.amazontrust.com/r2s10/6WWO9aqC15m.crl, http://crl.r2001.amazontrust.com/r2s10/5K1qPy8q6lS.crl, http://crl.r2001.amazontrust.com/r2s10/71c3hUuKLQl.crl, http://crl.r2001.amazontrust.com/r2s10/AdMQCKSxA7B.crl, http://crl.r2001.amazontrust.com/r2s10/Kg2b0oQstWx.crl, http://crl.r2001.amazontrust.com/r2s10/2SrnZxDXiXY.crl, http://crl.r2001.amazontrust.com/r2s10/4ZTLjCXmHxZ.crl, http://crl.r2001.amazontrust.com/r2s10/PV4F1osUrk.crl, http://crl.r2001.amazontrust.com/r2s10/BPhp38qCQzW.crl, http://crl.r2001.amazontrust.com/r2s10/1EmKXuN3Iam.crl, http://crl.r2001.amazontrust.com/r2s10/ADfwcWukLPx.crl, http://crl.r2001.amazontrust.com/r2s10/5KW1CxeUbmm.crl, http://crl.r2001.amazontrust.com/r2s10/LZ9NYeu8hbB.crl, http://crl.r2001.amazontrust.com/r2s10/FFcdafYnIcy.crl, http://crl.r2001.amazontrust.com/r2s10/CEM0olCraFZ.crl, http://crl.r2001.amazontrust.com/r2s10/Dj7fHLkSsmQ.crl, http://crl.r2001.amazontrust.com/r2s10/ARKyTTAZgDi.crl, http://crl.r2001.amazontrust.com/r2s10/C2PDGC9c1qL.crl, http://crl.r2001.amazontrust.com/r2s10/DmbvirPY3O0.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6c:a2:f6:2e:3f:21:3c:ad:e2:f3:2a:1c:7b:76:76:8d:74:71:e4:b0
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Apr 22 19:25:30 2026 GMT
            Not After : Apr 21 19:25:30 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S10
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                23:28:0E:5F:26:74:2D:33:20:A1:1D:DA:C1:11:41:B7:4D:1F:A2:A9
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A38B75A1866AFFBDBD6FB6653214C09F13E3F3B3248E5B098FD6240A0B21F373
    SPKI SHA256: A477C4564709BACECA036AF1D9BA1C4B8A0D7030C4DBF6574FB0158947FC8C18
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S11

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S11
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 689CA0EF3276578A9E6ADA08866AB85944E9B17A
- SHA-256: FE5030D0B4CFA4DE1E286E75B5E4716271F1A4789CF546C485179F9FAE57FE01
- SPKI SHA-256: 6CED65DBE31F8278ED38CD7F3EC76FFB41C0218356050D506228577D3A11F154
- Validity: 2026-04-22 to 2029-04-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r2001.amazontrust.com/r2s11/fa8af87a-1123-4e2c-9523-47693c3add1b.crl, http://crl.r2001.amazontrust.com/r2s11/20jP8UKgFNl.crl, http://crl.r2001.amazontrust.com/r2s11/5Kf0mJMPlu9.crl, http://crl.r2001.amazontrust.com/r2s11/5xaK8yJ5Mr.crl, http://crl.r2001.amazontrust.com/r2s11/5zqpFqMhCe0.crl, http://crl.r2001.amazontrust.com/r2s11/64XEMfBghTy.crl, http://crl.r2001.amazontrust.com/r2s11/7qBTOQMu3bk.crl, http://crl.r2001.amazontrust.com/r2s11/85erNQK7veX.crl, http://crl.r2001.amazontrust.com/r2s11/BTwXmHyzAgV.crl, http://crl.r2001.amazontrust.com/r2s11/D9qTv6y0aPd.crl, http://crl.r2001.amazontrust.com/r2s11/JNkEFwbxtEH.crl, http://crl.r2001.amazontrust.com/r2s11/Jjjv4rbHfjo.crl, http://crl.r2001.amazontrust.com/r2s11/K3yzdFDS4rS.crl, http://crl.r2001.amazontrust.com/r2s11/KPmWfjhfxkh.crl, http://crl.r2001.amazontrust.com/r2s11/KReOP5vVAj6.crl, http://crl.r2001.amazontrust.com/r2s11/6S4zSv6yoHq.crl, http://crl.r2001.amazontrust.com/r2s11/FVK7HmTe6tU.crl, http://crl.r2001.amazontrust.com/r2s11/JqyLYQEw3sp.crl, http://crl.r2001.amazontrust.com/r2s11/KmGy5d3Vdnb.crl, http://crl.r2001.amazontrust.com/r2s11/KvpjXaVEDEn.crl, http://crl.r2001.amazontrust.com/r2s11/Lb5mccEh6vd.crl, http://crl.r2001.amazontrust.com/r2s11/1h08R8jyOCl.crl, http://crl.r2001.amazontrust.com/r2s11/2PDq9guWF7R.crl, http://crl.r2001.amazontrust.com/r2s11/2rC9WDAVbaZ.crl, http://crl.r2001.amazontrust.com/r2s11/52MG4TJp87r.crl, http://crl.r2001.amazontrust.com/r2s11/6lbyjSxbujs.crl, http://crl.r2001.amazontrust.com/r2s11/8YHgAtC0ppG.crl, http://crl.r2001.amazontrust.com/r2s11/95saSfA24I7.crl, http://crl.r2001.amazontrust.com/r2s11/BjH5RX3zkFM.crl, http://crl.r2001.amazontrust.com/r2s11/Ju6jWJCke0z.crl, http://crl.r2001.amazontrust.com/r2s11/LRZBED5wMrb.crl, http://crl.r2001.amazontrust.com/r2s11/3486PlrnDIV.crl, http://crl.r2001.amazontrust.com/r2s11/4gHCDfjb8hx.crl, http://crl.r2001.amazontrust.com/r2s11/50ufKv48Yss.crl, http://crl.r2001.amazontrust.com/r2s11/5XP4hSh4lZY.crl, http://crl.r2001.amazontrust.com/r2s11/9zs3wphoFOX.crl, http://crl.r2001.amazontrust.com/r2s11/BN3jSKUvFOk.crl, http://crl.r2001.amazontrust.com/r2s11/FgEoteQIuMH.crl, http://crl.r2001.amazontrust.com/r2s11/1pF15QppLyg.crl, http://crl.r2001.amazontrust.com/r2s11/4cfEirbvS8v.crl, http://crl.r2001.amazontrust.com/r2s11/6tPknxXReGi.crl, http://crl.r2001.amazontrust.com/r2s11/HM6OexShmaK.crl, http://crl.r2001.amazontrust.com/r2s11/WIv0WjghdQ.crl, http://crl.r2001.amazontrust.com/r2s11/2dSD68b4L1C.crl, http://crl.r2001.amazontrust.com/r2s11/AiVZP8Q6HUE.crl, http://crl.r2001.amazontrust.com/r2s11/DGs72I1rAU6.crl, http://crl.r2001.amazontrust.com/r2s11/FJKaC8Hycjj.crl, http://crl.r2001.amazontrust.com/r2s11/HRCbpQmdZlg.crl, http://crl.r2001.amazontrust.com/r2s11/K8w02s9aj81.crl, http://crl.r2001.amazontrust.com/r2s11/1PmeXQ8lcMY.crl, http://crl.r2001.amazontrust.com/r2s11/3rm0w4FHb5d.crl, http://crl.r2001.amazontrust.com/r2s11/8b2jm6JR4wD.crl, http://crl.r2001.amazontrust.com/r2s11/AfwRm6AVXHF.crl, http://crl.r2001.amazontrust.com/r2s11/DIirqwCq6BJ.crl, http://crl.r2001.amazontrust.com/r2s11/EFrxDWMZhEi.crl, http://crl.r2001.amazontrust.com/r2s11/ICevoYFZyAU.crl, http://crl.r2001.amazontrust.com/r2s11/L8X1EJpj1AE.crl, http://crl.r2001.amazontrust.com/r2s11/LoKQAX88Pi9.crl, http://crl.r2001.amazontrust.com/r2s11/48xfBQpyQf6.crl, http://crl.r2001.amazontrust.com/r2s11/9kyfEvTMYOg.crl, http://crl.r2001.amazontrust.com/r2s11/8yIPOJe2ji1.crl, http://crl.r2001.amazontrust.com/r2s11/9OHeE7gQl1U.crl, http://crl.r2001.amazontrust.com/r2s11/1djoULwmVDL.crl, http://crl.r2001.amazontrust.com/r2s11/5ICaHQlP0H0.crl, http://crl.r2001.amazontrust.com/r2s11/76aNQXBTn3T.crl, http://crl.r2001.amazontrust.com/r2s11/Cfv7gTXPMCC.crl, http://crl.r2001.amazontrust.com/r2s11/DnZLnurirLg.crl, http://crl.r2001.amazontrust.com/r2s11/Hja9OP3GLN4.crl, http://crl.r2001.amazontrust.com/r2s11/fSpkuJgBOe.crl, http://crl.r2001.amazontrust.com/r2s11/FrMk4fsdFUj.crl, http://crl.r2001.amazontrust.com/r2s11/IOR6BZ5B1d9.crl, http://crl.r2001.amazontrust.com/r2s11/2P5Aauznkpt.crl, http://crl.r2001.amazontrust.com/r2s11/44AGqZytYxS.crl, http://crl.r2001.amazontrust.com/r2s11/9VlU6nmN8Sp.crl, http://crl.r2001.amazontrust.com/r2s11/Ho6bVrFS7vh.crl, http://crl.r2001.amazontrust.com/r2s11/1SHqOpulrrO.crl, http://crl.r2001.amazontrust.com/r2s11/75XaWr9IWxA.crl, http://crl.r2001.amazontrust.com/r2s11/CQzDZREx1q6.crl, http://crl.r2001.amazontrust.com/r2s11/GVGesqUiWGk.crl, http://crl.r2001.amazontrust.com/r2s11/BCOfkQcMjpv.crl, http://crl.r2001.amazontrust.com/r2s11/HMc85xE5qii.crl, http://crl.r2001.amazontrust.com/r2s11/HhIK3X2pUHn.crl, http://crl.r2001.amazontrust.com/r2s11/I1AbjG0hW7Z.crl, http://crl.r2001.amazontrust.com/r2s11/JaKgPjdwjOB.crl, http://crl.r2001.amazontrust.com/r2s11/psGhxF0AcV.crl, http://crl.r2001.amazontrust.com/r2s11/1n1MvztUaMA.crl, http://crl.r2001.amazontrust.com/r2s11/GoxsdwJRVoh.crl, http://crl.r2001.amazontrust.com/r2s11/CzKS5txxkYF.crl, http://crl.r2001.amazontrust.com/r2s11/Bs5QKZEOFWs.crl, http://crl.r2001.amazontrust.com/r2s11/I8OZ3Xtmx8Z.crl, http://crl.r2001.amazontrust.com/r2s11/A0cp4F3yux1.crl, http://crl.r2001.amazontrust.com/r2s11/8JtTnwwSmo2.crl, http://crl.r2001.amazontrust.com/r2s11/9HqK7ji3SmN.crl, http://crl.r2001.amazontrust.com/r2s11/A8gKdLC00wC.crl, http://crl.r2001.amazontrust.com/r2s11/J7URfILj5Ol.crl, http://crl.r2001.amazontrust.com/r2s11/4Tf2gS4wCpJ.crl, http://crl.r2001.amazontrust.com/r2s11/4WU4a6dGEu8.crl, http://crl.r2001.amazontrust.com/r2s11/BEZ64TzBug4.crl, http://crl.r2001.amazontrust.com/r2s11/V6KmFhERc7.crl, http://crl.r2001.amazontrust.com/r2s11/8WHyfOv3Ndq.crl, http://crl.r2001.amazontrust.com/r2s11/32MWscI5ZrH.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            68:9c:a0:ef:32:76:57:8a:9e:6a:da:08:86:6a:b8:59:44:e9:b1:7a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Apr 22 19:25:35 2026 GMT
            Not After : Apr 21 19:25:35 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S11
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                56:5A:50:43:A4:75:C3:E0:0F:63:8D:2C:4F:37:CD:2E:69:06:14:0C
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FE5030D0B4CFA4DE1E286E75B5E4716271F1A4789CF546C485179F9FAE57FE01
    SPKI SHA256: 6CED65DBE31F8278ED38CD7F3EC76FFB41C0218356050D506228577D3A11F154
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S12

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S12
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 3BFB81F4667E0FE95711CEE13B93677CA428DEE7
- SHA-256: 52EB389BBDC400BC0A93C2D7713AE893137EE7A8DBC418C74F43D49619B1FB91
- SPKI SHA-256: 6C4507A6B2F158ECCC5272DA4EC7A7E3E6DE712092465D5337B5A6C3861B8A0C
- Validity: 2026-07-08 to 2029-07-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3b:fb:81:f4:66:7e:0f:e9:57:11:ce:e1:3b:93:67:7c:a4:28:de:e7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Jul  8 19:27:52 2026 GMT
            Not After : Jul  7 19:27:52 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S12
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                E6:74:1E:F2:5C:EF:03:62:05:F6:9D:54:3D:37:74:9F:8B:83:E8:27
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 52EB389BBDC400BC0A93C2D7713AE893137EE7A8DBC418C74F43D49619B1FB91
    SPKI SHA256: 6C4507A6B2F158ECCC5272DA4EC7A7E3E6DE712092465D5337B5A6C3861B8A0C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S13

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S13
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 5E6EBB13952EE12A8133EFD77AD75BBEC89CFB78
- SHA-256: 2EE796CC437A9E971FD3B67B737242012773D87B9289DAA9E13F7EA32708A22F
- SPKI SHA-256: 6CFB7F7D219EC46C2183F38D0C1CF2CD0735D14724EF9AD8CCCD4FEFB28030E6
- Validity: 2026-07-08 to 2029-07-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5e:6e:bb:13:95:2e:e1:2a:81:33:ef:d7:7a:d7:5b:be:c8:9c:fb:78
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Jul  8 19:27:57 2026 GMT
            Not After : Jul  7 19:27:57 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S13
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                35:11:2E:80:08:4A:77:1A:54:E0:77:02:3C:36:19:35:AE:41:8C:B9
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2EE796CC437A9E971FD3B67B737242012773D87B9289DAA9E13F7EA32708A22F
    SPKI SHA256: 6CFB7F7D219EC46C2183F38D0C1CF2CD0735D14724EF9AD8CCCD4FEFB28030E6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S14

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S14
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 01B1905B386941793A3512935450F8B9522B0891
- SHA-256: AFF34C5497195F13C8A9A5D09B6AF21364DC1F3813ECF94EED0DAB683E15F97F
- SPKI SHA-256: C7D9621555E6B69ABF2277D3862EC9E0A1C8E7391FF62659488A33CD004855A8
- Validity: 2026-07-08 to 2029-07-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:b1:90:5b:38:69:41:79:3a:35:12:93:54:50:f8:b9:52:2b:08:91
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Jul  8 19:28:03 2026 GMT
            Not After : Jul  7 19:28:03 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S14
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                A4:DA:7A:19:3A:A9:F2:85:99:6A:9B:69:AB:07:EF:3B:11:23:0E:E1
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AFF34C5497195F13C8A9A5D09B6AF21364DC1F3813ECF94EED0DAB683E15F97F
    SPKI SHA256: C7D9621555E6B69ABF2277D3862EC9E0A1C8E7391FF62659488A33CD004855A8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S15

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S15
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 17C6AEECB56E6E3835FA2BA1077D04ACAAE98F13
- SHA-256: 351ABB5189DCE3ACD5E0484A8B6AECD5D775F37692702150E20ED309FB5F8B03
- SPKI SHA-256: 820D187138F98CE426F36A3214B660B87A63B5F4946904BAE6EB5C573AC45DBE
- Validity: 2026-07-08 to 2029-07-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            17:c6:ae:ec:b5:6e:6e:38:35:fa:2b:a1:07:7d:04:ac:aa:e9:8f:13
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Jul  8 19:28:08 2026 GMT
            Not After : Jul  7 19:28:08 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S15
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                A8:40:D1:1A:67:E3:91:3B:FF:6E:2D:6D:C2:FE:2C:27:3B:45:22:F1
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 351ABB5189DCE3ACD5E0484A8B6AECD5D775F37692702150E20ED309FB5F8B03
    SPKI SHA256: 820D187138F98CE426F36A3214B660B87A63B5F4946904BAE6EB5C573AC45DBE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S16

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S16
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 0503CADD409307D4AAC538386571E806B1D8EB69
- SHA-256: 33D789BD96B40709982E9B88C6BFCF742D6610D0F9A322B620B24FC6E7B9E49E
- SPKI SHA-256: C05D9F9521552E399C7D28AF2C5B66F7628DB05FD9842550D3175D84A0926621
- Validity: 2026-07-08 to 2029-07-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            05:03:ca:dd:40:93:07:d4:aa:c5:38:38:65:71:e8:06:b1:d8:eb:69
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Jul  8 19:28:13 2026 GMT
            Not After : Jul  7 19:28:13 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S16
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                FA:E3:68:82:87:57:A1:58:9C:12:B2:F5:8F:7E:82:9A:37:22:5A:68
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 33D789BD96B40709982E9B88C6BFCF742D6610D0F9A322B620B24FC6E7B9E49E
    SPKI SHA256: C05D9F9521552E399C7D28AF2C5B66F7628DB05FD9842550D3175D84A0926621
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S17

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S17
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 509442C1B97C57D9716103D884449B13775F69DD
- SHA-256: 1803A03804B1B20BD6B064E6574978942F8EF6FCF2AFCF28CF516F382F8DEC47
- SPKI SHA-256: AA251DCEA6614002C5573845D660C2EA82A80F9C091025329A2B47A9D76F996C
- Validity: 2026-07-08 to 2029-07-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            50:94:42:c1:b9:7c:57:d9:71:61:03:d8:84:44:9b:13:77:5f:69:dd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Jul  8 19:28:18 2026 GMT
            Not After : Jul  7 19:28:18 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S17
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                4B:83:EF:F7:D4:B6:DF:24:66:16:04:6A:4B:5D:46:6C:A6:39:8A:02
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1803A03804B1B20BD6B064E6574978942F8EF6FCF2AFCF28CF516F382F8DEC47
    SPKI SHA256: AA251DCEA6614002C5573845D660C2EA82A80F9C091025329A2B47A9D76F996C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S18

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S18
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 046CB6D1A8A89259AD54F0257A3A0932FCF03E4D
- SHA-256: 7529A73C4D0F371A9C76AFB443374960B9969CAF431FDF5A15EB7028D40078B0
- SPKI SHA-256: D0B8C7AFE7DC9B6108FDDAEFC40717FEFE459306D4903139F316E040588B8CFA
- Validity: 2026-07-08 to 2029-07-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r2s18.amazontrust.com/0381d402-be02-4f76-a46c-101cf54501b0.crl, http://crl.r2s18.amazontrust.com/5X6fp.crl, http://crl.r2s18.amazontrust.com/Am8pZ.crl, http://crl.r2s18.amazontrust.com/5bMXu.crl, http://crl.r2s18.amazontrust.com/5Ucka.crl, http://crl.r2s18.amazontrust.com/10L34.crl, http://crl.r2s18.amazontrust.com/5ycEa.crl, http://crl.r2s18.amazontrust.com/7K75J.crl, http://crl.r2s18.amazontrust.com/86z0g.crl, http://crl.r2s18.amazontrust.com/8rlLH.crl, http://crl.r2s18.amazontrust.com/9FP2l.crl, http://crl.r2s18.amazontrust.com/A1nAb.crl, http://crl.r2s18.amazontrust.com/AQQSc.crl, http://crl.r2s18.amazontrust.com/BBlDC.crl, http://crl.r2s18.amazontrust.com/BSKCT.crl, http://crl.r2s18.amazontrust.com/BTbMf.crl, http://crl.r2s18.amazontrust.com/BXExV.crl, http://crl.r2s18.amazontrust.com/BYKgX.crl, http://crl.r2s18.amazontrust.com/C9969.crl, http://crl.r2s18.amazontrust.com/DOtEC.crl, http://crl.r2s18.amazontrust.com/DQV0c.crl, http://crl.r2s18.amazontrust.com/DqodN.crl, http://crl.r2s18.amazontrust.com/FFCNL.crl, http://crl.r2s18.amazontrust.com/GT3BW.crl, http://crl.r2s18.amazontrust.com/H0rz5.crl, http://crl.r2s18.amazontrust.com/HOPSG.crl, http://crl.r2s18.amazontrust.com/HWvyS.crl, http://crl.r2s18.amazontrust.com/Hwqv3.crl, http://crl.r2s18.amazontrust.com/I2GsI.crl, http://crl.r2s18.amazontrust.com/IH9vL.crl, http://crl.r2s18.amazontrust.com/JNplU.crl, http://crl.r2s18.amazontrust.com/KCgPC.crl, http://crl.r2s18.amazontrust.com/LFJsU.crl, http://crl.r2s18.amazontrust.com/LWLWB.crl, http://crl.r2s18.amazontrust.com/M6wci.crl, http://crl.r2s18.amazontrust.com/VLIgx.crl, http://crl.r2s18.amazontrust.com/XMXJW.crl, http://crl.r2s18.amazontrust.com/Yjnuu.crl, http://crl.r2s18.amazontrust.com/LTw13.crl, http://crl.r2s18.amazontrust.com/57hL1.crl, http://crl.r2s18.amazontrust.com/6X8i0.crl, http://crl.r2s18.amazontrust.com/75RXO.crl, http://crl.r2s18.amazontrust.com/G9iLH.crl, http://crl.r2s18.amazontrust.com/GshiN.crl, http://crl.r2s18.amazontrust.com/HfFkN.crl, http://crl.r2s18.amazontrust.com/J89Qp.crl, http://crl.r2s18.amazontrust.com/KX56K.crl, http://crl.r2s18.amazontrust.com/1SSHE.crl, http://crl.r2s18.amazontrust.com/9f0cG.crl, http://crl.r2s18.amazontrust.com/Eicr0.crl, http://crl.r2s18.amazontrust.com/Frluo.crl, http://crl.r2s18.amazontrust.com/JcjQI.crl, http://crl.r2s18.amazontrust.com/K9ueL.crl, http://crl.r2s18.amazontrust.com/4D4aZ.crl, http://crl.r2s18.amazontrust.com/4biAd.crl, http://crl.r2s18.amazontrust.com/5PaCP.crl, http://crl.r2s18.amazontrust.com/BaDbv.crl, http://crl.r2s18.amazontrust.com/EJly3.crl, http://crl.r2s18.amazontrust.com/2pRr2.crl, http://crl.r2s18.amazontrust.com/3PknF.crl, http://crl.r2s18.amazontrust.com/6fgO9.crl, http://crl.r2s18.amazontrust.com/7Roqq.crl, http://crl.r2s18.amazontrust.com/8b5Lw.crl, http://crl.r2s18.amazontrust.com/KvfES.crl, http://crl.r2s18.amazontrust.com/3qtGs.crl, http://crl.r2s18.amazontrust.com/AadXw.crl, http://crl.r2s18.amazontrust.com/CgLLi.crl, http://crl.r2s18.amazontrust.com/FUGmc.crl, http://crl.r2s18.amazontrust.com/JF22V.crl, http://crl.r2s18.amazontrust.com/EpgPw.crl, http://crl.r2s18.amazontrust.com/IYMxY.crl, http://crl.r2s18.amazontrust.com/Lc0oW.crl, http://crl.r2s18.amazontrust.com/4y2dl.crl, http://crl.r2s18.amazontrust.com/GXyfi.crl, http://crl.r2s18.amazontrust.com/1QIbN.crl, http://crl.r2s18.amazontrust.com/8yxQE.crl, http://crl.r2s18.amazontrust.com/DEJxc.crl, http://crl.r2s18.amazontrust.com/FokXw.crl, http://crl.r2s18.amazontrust.com/Lq1EH.crl, http://crl.r2s18.amazontrust.com/2thMm.crl, http://crl.r2s18.amazontrust.com/8tSQW.crl, http://crl.r2s18.amazontrust.com/CQeVm.crl, http://crl.r2s18.amazontrust.com/FhJGe.crl, http://crl.r2s18.amazontrust.com/BLogG.crl, http://crl.r2s18.amazontrust.com/LwTaj.crl, http://crl.r2s18.amazontrust.com/9yyk8.crl, http://crl.r2s18.amazontrust.com/GmPF0.crl, http://crl.r2s18.amazontrust.com/c48f9.crl, http://crl.r2s18.amazontrust.com/8fovq.crl, http://crl.r2s18.amazontrust.com/9mkJR.crl, http://crl.r2s18.amazontrust.com/6CDwH.crl, http://crl.r2s18.amazontrust.com/EA2L6.crl, http://crl.r2s18.amazontrust.com/5XMdm.crl, http://crl.r2s18.amazontrust.com/Epp9h.crl, http://crl.r2s18.amazontrust.com/KLojf.crl, http://crl.r2s18.amazontrust.com/DYr0g.crl, http://crl.r2s18.amazontrust.com/1MDXa.crl, http://crl.r2s18.amazontrust.com/5fQCU.crl, http://crl.r2s18.amazontrust.com/LNGFk.crl, http://crl.r2s18.amazontrust.com/4UaHt.crl, http://crl.r2s18.amazontrust.com/J1SJH.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:6c:b6:d1:a8:a8:92:59:ad:54:f0:25:7a:3a:09:32:fc:f0:3e:4d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Jul  8 19:28:23 2026 GMT
            Not After : Jul  7 19:28:23 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S18
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                DE:42:FF:E3:C5:37:72:F9:23:5E:0B:F6:5A:F2:4F:B1:76:3B:C0:94
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7529A73C4D0F371A9C76AFB443374960B9969CAF431FDF5A15EB7028D40078B0
    SPKI SHA256: D0B8C7AFE7DC9B6108FDDAEFC40717FEFE459306D4903139F316E040588B8CFA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S19

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S19
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 3E66530C008BAB6B9A6D90C1F0D323DAC30EEECA
- SHA-256: 04091B1D552BF3556E2823479BF2A4E7F2DE3013895F9837FBE697FB7D4C1EA8
- SPKI SHA-256: DA235F9D203DDFA5094B2BC2589140F76A39C45EE0CE0C98C55AB7C630DBE9D1
- Validity: 2026-07-08 to 2029-07-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r2s19.amazontrust.com/dd727557-3ab0-4e5f-8b71-4c72d1416da7.crl, http://crl.r2s19.amazontrust.com/EhZNa.crl, http://crl.r2s19.amazontrust.com/H6c2r.crl, http://crl.r2s19.amazontrust.com/1Tv1W.crl, http://crl.r2s19.amazontrust.com/3mLNK.crl, http://crl.r2s19.amazontrust.com/3aj1R.crl, http://crl.r2s19.amazontrust.com/5BIqz.crl, http://crl.r2s19.amazontrust.com/5XCS2.crl, http://crl.r2s19.amazontrust.com/5gMFb.crl, http://crl.r2s19.amazontrust.com/5tr4i.crl, http://crl.r2s19.amazontrust.com/6Mktd.crl, http://crl.r2s19.amazontrust.com/6PDhw.crl, http://crl.r2s19.amazontrust.com/6kIgd.crl, http://crl.r2s19.amazontrust.com/79YiN.crl, http://crl.r2s19.amazontrust.com/9ENGb.crl, http://crl.r2s19.amazontrust.com/9UFD9.crl, http://crl.r2s19.amazontrust.com/9vRpS.crl, http://crl.r2s19.amazontrust.com/AGkdi.crl, http://crl.r2s19.amazontrust.com/AMBpu.crl, http://crl.r2s19.amazontrust.com/CTxFF.crl, http://crl.r2s19.amazontrust.com/D3ote.crl, http://crl.r2s19.amazontrust.com/DwosR.crl, http://crl.r2s19.amazontrust.com/Ew7vu.crl, http://crl.r2s19.amazontrust.com/HRck0.crl, http://crl.r2s19.amazontrust.com/Ie47e.crl, http://crl.r2s19.amazontrust.com/JtdAC.crl, http://crl.r2s19.amazontrust.com/LPIuN.crl, http://crl.r2s19.amazontrust.com/LbsBM.crl, http://crl.r2s19.amazontrust.com/ga3PN.crl, http://crl.r2s19.amazontrust.com/1wGBf.crl, http://crl.r2s19.amazontrust.com/51MOV.crl, http://crl.r2s19.amazontrust.com/5eKol.crl, http://crl.r2s19.amazontrust.com/5kTib.crl, http://crl.r2s19.amazontrust.com/62WzY.crl, http://crl.r2s19.amazontrust.com/8vjkn.crl, http://crl.r2s19.amazontrust.com/9xw6D.crl, http://crl.r2s19.amazontrust.com/GfMgi.crl, http://crl.r2s19.amazontrust.com/Hprkh.crl, http://crl.r2s19.amazontrust.com/KYc4Z.crl, http://crl.r2s19.amazontrust.com/LXe5b.crl, http://crl.r2s19.amazontrust.com/1sWTh.crl, http://crl.r2s19.amazontrust.com/FT7b0.crl, http://crl.r2s19.amazontrust.com/G3wHs.crl, http://crl.r2s19.amazontrust.com/GEjUw.crl, http://crl.r2s19.amazontrust.com/LwEWY.crl, http://crl.r2s19.amazontrust.com/3fjDJ.crl, http://crl.r2s19.amazontrust.com/5aODm.crl, http://crl.r2s19.amazontrust.com/9hF7i.crl, http://crl.r2s19.amazontrust.com/9hgGd.crl, http://crl.r2s19.amazontrust.com/BHG6U.crl, http://crl.r2s19.amazontrust.com/DGRMR.crl, http://crl.r2s19.amazontrust.com/L6mA8.crl, http://crl.r2s19.amazontrust.com/4CyB1.crl, http://crl.r2s19.amazontrust.com/90KMu.crl, http://crl.r2s19.amazontrust.com/C4GEz.crl, http://crl.r2s19.amazontrust.com/DFN4F.crl, http://crl.r2s19.amazontrust.com/DkeWP.crl, http://crl.r2s19.amazontrust.com/FttPA.crl, http://crl.r2s19.amazontrust.com/IROUt.crl, http://crl.r2s19.amazontrust.com/LKZeP.crl, http://crl.r2s19.amazontrust.com/EFdCC.crl, http://crl.r2s19.amazontrust.com/JvP2x.crl, http://crl.r2s19.amazontrust.com/KRdaF.crl, http://crl.r2s19.amazontrust.com/KqMne.crl, http://crl.r2s19.amazontrust.com/2uWDK.crl, http://crl.r2s19.amazontrust.com/AxU5A.crl, http://crl.r2s19.amazontrust.com/CpjyG.crl, http://crl.r2s19.amazontrust.com/KU5JS.crl, http://crl.r2s19.amazontrust.com/otJj7.crl, http://crl.r2s19.amazontrust.com/90LO0.crl, http://crl.r2s19.amazontrust.com/Lg4kk.crl, http://crl.r2s19.amazontrust.com/Lq4La.crl, http://crl.r2s19.amazontrust.com/64pO8.crl, http://crl.r2s19.amazontrust.com/DwlwX.crl, http://crl.r2s19.amazontrust.com/EJZi5.crl, http://crl.r2s19.amazontrust.com/GHa93.crl, http://crl.r2s19.amazontrust.com/52Ewo.crl, http://crl.r2s19.amazontrust.com/Bbim9.crl, http://crl.r2s19.amazontrust.com/ER0mT.crl, http://crl.r2s19.amazontrust.com/C1W4D.crl, http://crl.r2s19.amazontrust.com/DXQja.crl, http://crl.r2s19.amazontrust.com/EEPGd.crl, http://crl.r2s19.amazontrust.com/1a5IN.crl, http://crl.r2s19.amazontrust.com/7AQv6.crl, http://crl.r2s19.amazontrust.com/BMVKb.crl, http://crl.r2s19.amazontrust.com/EDKFS.crl, http://crl.r2s19.amazontrust.com/GqMmB.crl, http://crl.r2s19.amazontrust.com/29iCf.crl, http://crl.r2s19.amazontrust.com/4Cxrz.crl, http://crl.r2s19.amazontrust.com/CxtCe.crl, http://crl.r2s19.amazontrust.com/Dm6Hb.crl, http://crl.r2s19.amazontrust.com/lNOHv.crl, http://crl.r2s19.amazontrust.com/3XYb9.crl, http://crl.r2s19.amazontrust.com/FMhFs.crl, http://crl.r2s19.amazontrust.com/DKPBM.crl, http://crl.r2s19.amazontrust.com/2WzbR.crl, http://crl.r2s19.amazontrust.com/BSrfa.crl, http://crl.r2s19.amazontrust.com/3cwE0.crl, http://crl.r2s19.amazontrust.com/JcGgo.crl, http://crl.r2s19.amazontrust.com/AzkCg.crl, http://crl.r2s19.amazontrust.com/DZYvC.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3e:66:53:0c:00:8b:ab:6b:9a:6d:90:c1:f0:d3:23:da:c3:0e:ee:ca
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Jul  8 19:28:28 2026 GMT
            Not After : Jul  7 19:28:28 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S19
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                1C:92:46:F9:90:45:3A:F4:2E:57:A9:76:23:F2:2A:B1:91:19:6A:12
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 04091B1D552BF3556E2823479BF2A4E7F2DE3013895F9837FBE697FB7D4C1EA8
    SPKI SHA256: DA235F9D203DDFA5094B2BC2589140F76A39C45EE0CE0C98C55AB7C630DBE9D1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S20

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S20
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 0B95EFA916A4E6CFF9D8348F039FD125B981B5BD
- SHA-256: 8E5DE9110E08E11B0D3A566AFD0A762780A39660CF6B9339336DD51EE1FA9317
- SPKI SHA-256: E69EF31896ED2135F4EDCE55C8F6FDC3E003E0E3C6EE904CEF13EA7F98733520
- Validity: 2026-07-08 to 2029-07-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r2s20.amazontrust.com/051bada0-d219-4d6e-9113-518251529a5d.crl, http://crl.r2s20.amazontrust.com/JW7e1.crl, http://crl.r2s20.amazontrust.com/K2qep.crl, http://crl.r2s20.amazontrust.com/4COMd.crl, http://crl.r2s20.amazontrust.com/03kqO.crl, http://crl.r2s20.amazontrust.com/1vFGL.crl, http://crl.r2s20.amazontrust.com/1x3bp.crl, http://crl.r2s20.amazontrust.com/6488k.crl, http://crl.r2s20.amazontrust.com/6QP0D.crl, http://crl.r2s20.amazontrust.com/7gcsR.crl, http://crl.r2s20.amazontrust.com/7yz0y.crl, http://crl.r2s20.amazontrust.com/8KHBp.crl, http://crl.r2s20.amazontrust.com/9ZczO.crl, http://crl.r2s20.amazontrust.com/Bhyhq.crl, http://crl.r2s20.amazontrust.com/BjcDo.crl, http://crl.r2s20.amazontrust.com/CKOQz.crl, http://crl.r2s20.amazontrust.com/D0KP4.crl, http://crl.r2s20.amazontrust.com/DCRgm.crl, http://crl.r2s20.amazontrust.com/DW9fn.crl, http://crl.r2s20.amazontrust.com/DXuHk.crl, http://crl.r2s20.amazontrust.com/EwEXW.crl, http://crl.r2s20.amazontrust.com/F2XaU.crl, http://crl.r2s20.amazontrust.com/GBWx1.crl, http://crl.r2s20.amazontrust.com/HS9KA.crl, http://crl.r2s20.amazontrust.com/HSt1t.crl, http://crl.r2s20.amazontrust.com/IBJRr.crl, http://crl.r2s20.amazontrust.com/II4CF.crl, http://crl.r2s20.amazontrust.com/ITjw6.crl, http://crl.r2s20.amazontrust.com/IYg9q.crl, http://crl.r2s20.amazontrust.com/IgWaq.crl, http://crl.r2s20.amazontrust.com/JJp5c.crl, http://crl.r2s20.amazontrust.com/KPv7T.crl, http://crl.r2s20.amazontrust.com/LMyRr.crl, http://crl.r2s20.amazontrust.com/LW90d.crl, http://crl.r2s20.amazontrust.com/LnzUT.crl, http://crl.r2s20.amazontrust.com/B3J7D.crl, http://crl.r2s20.amazontrust.com/2puwm.crl, http://crl.r2s20.amazontrust.com/13INh.crl, http://crl.r2s20.amazontrust.com/3yr1J.crl, http://crl.r2s20.amazontrust.com/4F8SR.crl, http://crl.r2s20.amazontrust.com/Ai1dg.crl, http://crl.r2s20.amazontrust.com/JoBTx.crl, http://crl.r2s20.amazontrust.com/1rIid.crl, http://crl.r2s20.amazontrust.com/BD7S9.crl, http://crl.r2s20.amazontrust.com/E3k4A.crl, http://crl.r2s20.amazontrust.com/FQ0Sl.crl, http://crl.r2s20.amazontrust.com/FtjDq.crl, http://crl.r2s20.amazontrust.com/HbW1D.crl, http://crl.r2s20.amazontrust.com/KX4Rf.crl, http://crl.r2s20.amazontrust.com/LSwbX.crl, http://crl.r2s20.amazontrust.com/57PwL.crl, http://crl.r2s20.amazontrust.com/5bgsq.crl, http://crl.r2s20.amazontrust.com/691nQ.crl, http://crl.r2s20.amazontrust.com/BKGWw.crl, http://crl.r2s20.amazontrust.com/BsyhW.crl, http://crl.r2s20.amazontrust.com/C2a9p.crl, http://crl.r2s20.amazontrust.com/IkDyg.crl, http://crl.r2s20.amazontrust.com/IkhuU.crl, http://crl.r2s20.amazontrust.com/KvR7s.crl, http://crl.r2s20.amazontrust.com/L4PUq.crl, http://crl.r2s20.amazontrust.com/9W75H.crl, http://crl.r2s20.amazontrust.com/EMyFt.crl, http://crl.r2s20.amazontrust.com/K8GwZ.crl, http://crl.r2s20.amazontrust.com/7YBEw.crl, http://crl.r2s20.amazontrust.com/8alq3.crl, http://crl.r2s20.amazontrust.com/B7iw5.crl, http://crl.r2s20.amazontrust.com/CQLS0.crl, http://crl.r2s20.amazontrust.com/Dt2Jk.crl, http://crl.r2s20.amazontrust.com/LnHx4.crl, http://crl.r2s20.amazontrust.com/1wuHt.crl, http://crl.r2s20.amazontrust.com/6ggmx.crl, http://crl.r2s20.amazontrust.com/B4ttY.crl, http://crl.r2s20.amazontrust.com/EGROw.crl, http://crl.r2s20.amazontrust.com/ELb7b.crl, http://crl.r2s20.amazontrust.com/34UrK.crl, http://crl.r2s20.amazontrust.com/6LmKq.crl, http://crl.r2s20.amazontrust.com/BQobC.crl, http://crl.r2s20.amazontrust.com/CLMED.crl, http://crl.r2s20.amazontrust.com/DIWB5.crl, http://crl.r2s20.amazontrust.com/HuMMk.crl, http://crl.r2s20.amazontrust.com/7FQOS.crl, http://crl.r2s20.amazontrust.com/DCMwQ.crl, http://crl.r2s20.amazontrust.com/JwY56.crl, http://crl.r2s20.amazontrust.com/K0L1q.crl, http://crl.r2s20.amazontrust.com/FGLLD.crl, http://crl.r2s20.amazontrust.com/KFo9n.crl, http://crl.r2s20.amazontrust.com/8Jx8I.crl, http://crl.r2s20.amazontrust.com/9XgwJ.crl, http://crl.r2s20.amazontrust.com/2KWST.crl, http://crl.r2s20.amazontrust.com/6PpDe.crl, http://crl.r2s20.amazontrust.com/IXFTW.crl, http://crl.r2s20.amazontrust.com/IGLd3.crl, http://crl.r2s20.amazontrust.com/1W8y1.crl, http://crl.r2s20.amazontrust.com/ILBRw.crl, http://crl.r2s20.amazontrust.com/7QlKm.crl, http://crl.r2s20.amazontrust.com/Fy53R.crl, http://crl.r2s20.amazontrust.com/37ZkZ.crl, http://crl.r2s20.amazontrust.com/5csCz.crl, http://crl.r2s20.amazontrust.com/6lmUj.crl, http://crl.r2s20.amazontrust.com/KAd3F.crl, http://crl.r2s20.amazontrust.com/KoX4W.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0b:95:ef:a9:16:a4:e6:cf:f9:d8:34:8f:03:9f:d1:25:b9:81:b5:bd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Jul  8 19:28:33 2026 GMT
            Not After : Jul  7 19:28:33 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S20
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                43:4A:84:C7:C9:F1:7F:40:36:4A:36:03:75:AA:C4:40:9A:6E:DF:5A
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8E5DE9110E08E11B0D3A566AFD0A762780A39660CF6B9339336DD51EE1FA9317
    SPKI SHA256: E69EF31896ED2135F4EDCE55C8F6FDC3E003E0E3C6EE904CEF13EA7F98733520
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S21

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S21
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 12619A08964AD9C07EEE9280FC66F5729F694B41
- SHA-256: B06193B2656F9003EDDA43F4B5C07A0280ADB2B6B482E2280955FC9E3B3EBBCE
- SPKI SHA-256: D8F6A944107CA0AF2F5941ADD85E4EBC39185CE097394E1A1D38873625896DCB
- Validity: 2026-07-08 to 2029-07-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.r2s21.amazontrust.com/a6cec9cc-b552-4c36-8df8-2c381eedf4bb.crl, http://crl.r2s21.amazontrust.com/JbmYk.crl, http://crl.r2s21.amazontrust.com/LcEPd.crl, http://crl.r2s21.amazontrust.com/13l5U.crl, http://crl.r2s21.amazontrust.com/25YPM.crl, http://crl.r2s21.amazontrust.com/2W8sm.crl, http://crl.r2s21.amazontrust.com/2pjNp.crl, http://crl.r2s21.amazontrust.com/3FiKq.crl, http://crl.r2s21.amazontrust.com/4LB3F.crl, http://crl.r2s21.amazontrust.com/4Mvht.crl, http://crl.r2s21.amazontrust.com/6gzap.crl, http://crl.r2s21.amazontrust.com/7E8Hj.crl, http://crl.r2s21.amazontrust.com/7I8bd.crl, http://crl.r2s21.amazontrust.com/7Qecw.crl, http://crl.r2s21.amazontrust.com/8RY20.crl, http://crl.r2s21.amazontrust.com/9GtqU.crl, http://crl.r2s21.amazontrust.com/9lFni.crl, http://crl.r2s21.amazontrust.com/AdaOh.crl, http://crl.r2s21.amazontrust.com/AoDvz.crl, http://crl.r2s21.amazontrust.com/AyMIS.crl, http://crl.r2s21.amazontrust.com/BXwUF.crl, http://crl.r2s21.amazontrust.com/BzIwI.crl, http://crl.r2s21.amazontrust.com/EKD5d.crl, http://crl.r2s21.amazontrust.com/Emmso.crl, http://crl.r2s21.amazontrust.com/EsRAB.crl, http://crl.r2s21.amazontrust.com/FgCQB.crl, http://crl.r2s21.amazontrust.com/H1hxv.crl, http://crl.r2s21.amazontrust.com/IPVdk.crl, http://crl.r2s21.amazontrust.com/IWGQP.crl, http://crl.r2s21.amazontrust.com/J5dIU.crl, http://crl.r2s21.amazontrust.com/Jdyfv.crl, http://crl.r2s21.amazontrust.com/K6D9C.crl, http://crl.r2s21.amazontrust.com/KuzX7.crl, http://crl.r2s21.amazontrust.com/LJNhs.crl, http://crl.r2s21.amazontrust.com/LbypX.crl, http://crl.r2s21.amazontrust.com/xHdSj.crl, http://crl.r2s21.amazontrust.com/5zt8P.crl, http://crl.r2s21.amazontrust.com/7bXs3.crl, http://crl.r2s21.amazontrust.com/BV9sT.crl, http://crl.r2s21.amazontrust.com/HbpwC.crl, http://crl.r2s21.amazontrust.com/J9RLq.crl, http://crl.r2s21.amazontrust.com/22oBh.crl, http://crl.r2s21.amazontrust.com/4fBGc.crl, http://crl.r2s21.amazontrust.com/4mUfq.crl, http://crl.r2s21.amazontrust.com/6siuy.crl, http://crl.r2s21.amazontrust.com/BYVdo.crl, http://crl.r2s21.amazontrust.com/DD6iF.crl, http://crl.r2s21.amazontrust.com/F19YP.crl, http://crl.r2s21.amazontrust.com/GG3Fa.crl, http://crl.r2s21.amazontrust.com/HedeB.crl, http://crl.r2s21.amazontrust.com/1c6Os.crl, http://crl.r2s21.amazontrust.com/3OGoe.crl, http://crl.r2s21.amazontrust.com/A0Fnr.crl, http://crl.r2s21.amazontrust.com/COhYB.crl, http://crl.r2s21.amazontrust.com/DjBa0.crl, http://crl.r2s21.amazontrust.com/HWVSl.crl, http://crl.r2s21.amazontrust.com/IwyKd.crl, http://crl.r2s21.amazontrust.com/Izv0p.crl, http://crl.r2s21.amazontrust.com/8TkEL.crl, http://crl.r2s21.amazontrust.com/COEfC.crl, http://crl.r2s21.amazontrust.com/I2IPW.crl, http://crl.r2s21.amazontrust.com/LT3lD.crl, http://crl.r2s21.amazontrust.com/LukVm.crl, http://crl.r2s21.amazontrust.com/2BLwa.crl, http://crl.r2s21.amazontrust.com/6OGML.crl, http://crl.r2s21.amazontrust.com/FgveB.crl, http://crl.r2s21.amazontrust.com/J2WsV.crl, http://crl.r2s21.amazontrust.com/KpC6J.crl, http://crl.r2s21.amazontrust.com/9QQN8.crl, http://crl.r2s21.amazontrust.com/Gfghz.crl, http://crl.r2s21.amazontrust.com/HcWeE.crl, http://crl.r2s21.amazontrust.com/3sIcy.crl, http://crl.r2s21.amazontrust.com/6M08j.crl, http://crl.r2s21.amazontrust.com/JYzlu.crl, http://crl.r2s21.amazontrust.com/4nzRY.crl, http://crl.r2s21.amazontrust.com/8Cye7.crl, http://crl.r2s21.amazontrust.com/BIk1J.crl, http://crl.r2s21.amazontrust.com/GggQF.crl, http://crl.r2s21.amazontrust.com/HJa8r.crl, http://crl.r2s21.amazontrust.com/IdfcE.crl, http://crl.r2s21.amazontrust.com/F6TQG.crl, http://crl.r2s21.amazontrust.com/Hez2E.crl, http://crl.r2s21.amazontrust.com/Itwvp.crl, http://crl.r2s21.amazontrust.com/BslXd.crl, http://crl.r2s21.amazontrust.com/Dz8P3.crl, http://crl.r2s21.amazontrust.com/73Xkw.crl, http://crl.r2s21.amazontrust.com/A1oSw.crl, http://crl.r2s21.amazontrust.com/EfeuD.crl, http://crl.r2s21.amazontrust.com/JQL8B.crl, http://crl.r2s21.amazontrust.com/5DUCT.crl, http://crl.r2s21.amazontrust.com/54EKB.crl, http://crl.r2s21.amazontrust.com/8jq3d.crl, http://crl.r2s21.amazontrust.com/G4Ca4.crl, http://crl.r2s21.amazontrust.com/HJE3a.crl, http://crl.r2s21.amazontrust.com/F4gWt.crl, http://crl.r2s21.amazontrust.com/K8kmh.crl, http://crl.r2s21.amazontrust.com/1NHpW.crl, http://crl.r2s21.amazontrust.com/7b2fj.crl, http://crl.r2s21.amazontrust.com/QDdDo.crl, http://crl.r2s21.amazontrust.com/LMnEc.crl, http://crl.r2s21.amazontrust.com/IcWc9.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            12:61:9a:08:96:4a:d9:c0:7e:ee:92:80:fc:66:f5:72:9f:69:4b:41
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Jul  8 19:28:38 2026 GMT
            Not After : Jul  7 19:28:38 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S21
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                0E:53:B3:73:EC:C5:CA:F1:DF:26:5D:63:3C:7A:27:18:2E:AC:D0:DC
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B06193B2656F9003EDDA43F4B5C07A0280ADB2B6B482E2280955FC9E3B3EBBCE
    SPKI SHA256: D8F6A944107CA0AF2F5941ADD85E4EBC39185CE097394E1A1D38873625896DCB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S22

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S22
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 0E2CCE9B8B5621211BDEB7B288F5A11E2472D630
- SHA-256: A6DA77CCC7F604F7C56F0C4921A9EDFEC279CEF1B93D2FBD3D0BDA5AAED72440
- SPKI SHA-256: C20ECD265A80CABF5F87EF7A690CFA9DF971EB7E704809C534A99FF34FFDE6DB
- Validity: 2026-07-08 to 2029-07-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0e:2c:ce:9b:8b:56:21:21:1b:de:b7:b2:88:f5:a1:1e:24:72:d6:30
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Jul  8 19:28:43 2026 GMT
            Not After : Jul  7 19:28:43 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S22
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                CD:92:54:85:96:25:24:70:97:10:1B:FC:8F:DB:45:8B:51:C8:C6:79
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A6DA77CCC7F604F7C56F0C4921A9EDFEC279CEF1B93D2FBD3D0BDA5AAED72440
    SPKI SHA256: C20ECD265A80CABF5F87EF7A690CFA9DF971EB7E704809C534A99FF34FFDE6DB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S23

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S23
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 61CE4E80A87B563B954DB8E843C3E74A3D3C59B8
- SHA-256: 235EF6809CAFF0EC5A0F1EDC36FB52CCDC328B5A4CC4630DAAA8839B387A836E
- SPKI SHA-256: 2EFB80C465F64375E2BA74BDED2193B9304E88DE647B5E0115AEB392420B276F
- Validity: 2026-07-08 to 2029-07-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:ce:4e:80:a8:7b:56:3b:95:4d:b8:e8:43:c3:e7:4a:3d:3c:59:b8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Jul  8 19:28:48 2026 GMT
            Not After : Jul  7 19:28:48 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S23
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                FD:91:94:BE:D8:7F:AF:59:37:BD:B9:3A:70:76:8C:06:74:11:D0:86
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 235EF6809CAFF0EC5A0F1EDC36FB52CCDC328B5A4CC4630DAAA8839B387A836E
    SPKI SHA256: 2EFB80C465F64375E2BA74BDED2193B9304E88DE647B5E0115AEB392420B276F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S24

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S24
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 56341B70D44850C618A59EE8D02502A3E354A24C
- SHA-256: E052B6CC2F2C2A872CCB1BF3F73D99CEB2BAEDFD4886C5452B57F7B89CD4BC8F
- SPKI SHA-256: BFDCA7A95E1B6F7B60B73BD10CF8A9E5633AEE622A0C008E58EFB109222B24BE
- Validity: 2026-07-08 to 2029-07-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            56:34:1b:70:d4:48:50:c6:18:a5:9e:e8:d0:25:02:a3:e3:54:a2:4c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Jul  8 19:28:53 2026 GMT
            Not After : Jul  7 19:28:53 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S24
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                08:42:D1:3F:25:78:2A:60:97:48:2A:79:63:D7:17:0D:4E:65:7D:0A
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E052B6CC2F2C2A872CCB1BF3F73D99CEB2BAEDFD4886C5452B57F7B89CD4BC8F
    SPKI SHA256: BFDCA7A95E1B6F7B60B73BD10CF8A9E5633AEE622A0C008E58EFB109222B24BE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 2048 S25

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 2048 S25
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 1
- Serial: 77570E1C2927048B87B9EBB9E7BD025D20DD5B1F
- SHA-256: 3A42E35D012808C29EDCD08A8E51E9838A771ABCFE3B82CBB89A7ADA930BA3A5
- SPKI SHA-256: 6E900BC6B57E80E03F87850193107EA75D1B5F77B566CF534680B43729314684
- Validity: 2026-07-08 to 2029-07-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- CRL DP: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:57:0e:1c:29:27:04:8b:87:b9:eb:b9:e7:bd:02:5d:20:dd:5b:1f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 1
        Validity
            Not Before: Jul  8 19:28:58 2026 GMT
            Not After : Jul  7 19:28:58 2029 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 2048 S25
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                7E:08:88:7C:9B:3A:2C:11:38:45:09:B9:86:19:67:8B:2D:3D:D4:5F
            X509v3 Authority Key Identifier:
                84:18:CC:85:34:EC:BC:0C:94:94:2E:08:59:9C:C7:B2:10:4E:0A:08
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca1.amazontrust.com
                CA Issuers - URI:http://crt.rootca1.amazontrust.com/rootca1.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca1.amazontrust.com/rootca1.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3A42E35D012808C29EDCD08A8E51E9838A771ABCFE3B82CBB89A7ADA930BA3A5
    SPKI SHA256: 6E900BC6B57E80E03F87850193107EA75D1B5F77B566CF534680B43729314684
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca1.amazontrust.com
- AIA CA Issuers: http://crt.rootca1.amazontrust.com/rootca1.cer
- CRL Distribution Points: http://crl.rootca1.amazontrust.com/rootca1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 4096 M01

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 4096 M01
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 2
- Serial: 07731251E87349337F2E259D8429ED578FD5C5
- SHA-256: 40FE28DC925D1A8A6B8F861863EB57CD30C6776416AB8A99920BAC7C925A4174
- SPKI SHA-256: 80F2381CDB611D54886CE0C5D6BCBA3580F8823B0E69BA257295BE2C48B1D016
- Validity: 2022-08-23 to 2030-08-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d960de8d-58e1-49cd-b021-b81d840df468, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2089114f-2403-404e-9861-bcfc60426e0f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf97e8d2-eb5b-4702-9635-a1e8fffb0903, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9260ceb-c627-473c-b934-7a2da4f8930b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b6f87753-9559-4ee9-a79a-517d669b7a9a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=69e3c555-0da9-4b06-a1c1-64756cddb5ac
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.r4m01.amazontrust.com/r4m01.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca2.amazontrust.com
- CRL DP: http://crl.rootca2.amazontrust.com/rootca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:73:12:51:e8:73:49:33:7f:2e:25:9d:84:29:ed:57:8f:d5:c5
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 2
        Validity
            Not Before: Aug 23 22:27:12 2022 GMT
            Not After : Aug 23 22:27:12 2030 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 4096 M01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                27:3B:B8:44:76:93:F1:3C:17:C3:4D:B3:BD:21:1D:64:99:67:7E:BC
            X509v3 Authority Key Identifier:
                B0:0C:F0:4C:30:F4:05:58:02:48:FD:33:E5:52:AF:4B:84:E3:66:52
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca2.amazontrust.com
                CA Issuers - URI:http://crt.rootca2.amazontrust.com/rootca2.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca2.amazontrust.com/rootca2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 40FE28DC925D1A8A6B8F861863EB57CD30C6776416AB8A99920BAC7C925A4174
    SPKI SHA256: 80F2381CDB611D54886CE0C5D6BCBA3580F8823B0E69BA257295BE2C48B1D016
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca2.amazontrust.com
- AIA CA Issuers: http://crt.rootca2.amazontrust.com/rootca2.cer
- CRL Distribution Points: http://crl.rootca2.amazontrust.com/rootca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 4096 M02

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 4096 M02
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 2
- Serial: 0773125B0C34C3C940299A9F04A39E5A52CCD9
- SHA-256: 2CC39F6789B967B0282AEACA4548F602A1B274E90D260773E9E7B0F7C0F13432
- SPKI SHA-256: 67607F428F737282B28AD520DF5003645BACE10EF92B62480419BDC12923C880
- Validity: 2022-08-23 to 2030-08-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d960de8d-58e1-49cd-b021-b81d840df468, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2089114f-2403-404e-9861-bcfc60426e0f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf97e8d2-eb5b-4702-9635-a1e8fffb0903, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9260ceb-c627-473c-b934-7a2da4f8930b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b6f87753-9559-4ee9-a79a-517d669b7a9a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=69e3c555-0da9-4b06-a1c1-64756cddb5ac
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.r4m02.amazontrust.com/r4m02.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca2.amazontrust.com
- CRL DP: http://crl.rootca2.amazontrust.com/rootca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:73:12:5b:0c:34:c3:c9:40:29:9a:9f:04:a3:9e:5a:52:cc:d9
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 2
        Validity
            Not Before: Aug 23 22:29:13 2022 GMT
            Not After : Aug 23 22:29:13 2030 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 4096 M02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                9E:71:1F:1A:1D:93:A9:D9:2D:8E:CC:48:53:3F:03:54:F3:9E:E6:66
            X509v3 Authority Key Identifier:
                B0:0C:F0:4C:30:F4:05:58:02:48:FD:33:E5:52:AF:4B:84:E3:66:52
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca2.amazontrust.com
                CA Issuers - URI:http://crt.rootca2.amazontrust.com/rootca2.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca2.amazontrust.com/rootca2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 2CC39F6789B967B0282AEACA4548F602A1B274E90D260773E9E7B0F7C0F13432
    SPKI SHA256: 67607F428F737282B28AD520DF5003645BACE10EF92B62480419BDC12923C880
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca2.amazontrust.com
- AIA CA Issuers: http://crt.rootca2.amazontrust.com/rootca2.cer
- CRL Distribution Points: http://crl.rootca2.amazontrust.com/rootca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 4096 M03

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 4096 M03
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 2
- Serial: 0773125EAA47CFE4CCFF3C1AA37FBEB02972F7
- SHA-256: 41BDC074EB9531EC81FEF08D9FFA16536F61FC59789265E95E89A4982AEF3F91
- SPKI SHA-256: 83F52093B8E6A76BDBB3F013E02B808F15ED79A5AAAFFCED8EB9AC370ACBDDB1
- Validity: 2022-08-23 to 2030-08-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d960de8d-58e1-49cd-b021-b81d840df468, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2089114f-2403-404e-9861-bcfc60426e0f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf97e8d2-eb5b-4702-9635-a1e8fffb0903, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9260ceb-c627-473c-b934-7a2da4f8930b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b6f87753-9559-4ee9-a79a-517d669b7a9a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=69e3c555-0da9-4b06-a1c1-64756cddb5ac
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.r4m03.amazontrust.com/r4m03.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca2.amazontrust.com
- CRL DP: http://crl.rootca2.amazontrust.com/rootca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:73:12:5e:aa:47:cf:e4:cc:ff:3c:1a:a3:7f:be:b0:29:72:f7
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 2
        Validity
            Not Before: Aug 23 22:30:01 2022 GMT
            Not After : Aug 23 22:30:01 2030 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 4096 M03
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                10:14:01:BB:00:D3:BD:B4:86:FA:7B:EF:B1:EE:96:BF:4A:44:E5:02
            X509v3 Authority Key Identifier:
                B0:0C:F0:4C:30:F4:05:58:02:48:FD:33:E5:52:AF:4B:84:E3:66:52
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca2.amazontrust.com
                CA Issuers - URI:http://crt.rootca2.amazontrust.com/rootca2.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca2.amazontrust.com/rootca2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 41BDC074EB9531EC81FEF08D9FFA16536F61FC59789265E95E89A4982AEF3F91
    SPKI SHA256: 83F52093B8E6A76BDBB3F013E02B808F15ED79A5AAAFFCED8EB9AC370ACBDDB1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca2.amazontrust.com
- AIA CA Issuers: http://crt.rootca2.amazontrust.com/rootca2.cer
- CRL Distribution Points: http://crl.rootca2.amazontrust.com/rootca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 4096 M04

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 4096 M04
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 2
- Serial: 07731263AF8F9FC16388A2A2E2CFA356730352
- SHA-256: 3B6FAB0AB11C14EEF9031969E0ADB037C8FCC3366728A6567623D3C26B3632CB
- SPKI SHA-256: 89910AA2843767685195FA31E41E63E6EA5019207104D89A94D8B65C1A05A927
- Validity: 2022-08-23 to 2030-08-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-08.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d960de8d-58e1-49cd-b021-b81d840df468, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2089114f-2403-404e-9861-bcfc60426e0f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf97e8d2-eb5b-4702-9635-a1e8fffb0903, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9260ceb-c627-473c-b934-7a2da4f8930b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b6f87753-9559-4ee9-a79a-517d669b7a9a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=69e3c555-0da9-4b06-a1c1-64756cddb5ac
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.r4m04.amazontrust.com/r4m04.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca2.amazontrust.com
- CRL DP: http://crl.rootca2.amazontrust.com/rootca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:73:12:63:af:8f:9f:c1:63:88:a2:a2:e2:cf:a3:56:73:03:52
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 2
        Validity
            Not Before: Aug 23 22:31:08 2022 GMT
            Not After : Aug 23 22:31:08 2030 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 4096 M04
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                46:33:08:90:85:B9:B5:20:F6:82:8E:A4:CC:6A:E4:D5:D1:92:02:CC
            X509v3 Authority Key Identifier:
                B0:0C:F0:4C:30:F4:05:58:02:48:FD:33:E5:52:AF:4B:84:E3:66:52
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca2.amazontrust.com
                CA Issuers - URI:http://crt.rootca2.amazontrust.com/rootca2.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca2.amazontrust.com/rootca2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 3B6FAB0AB11C14EEF9031969E0ADB037C8FCC3366728A6567623D3C26B3632CB
    SPKI SHA256: 89910AA2843767685195FA31E41E63E6EA5019207104D89A94D8B65C1A05A927
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca2.amazontrust.com
- AIA CA Issuers: http://crt.rootca2.amazontrust.com/rootca2.cer
- CRL Distribution Points: http://crl.rootca2.amazontrust.com/rootca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Amazon RSA 4096 M05

- Subject: countryName=US, organizationName=Amazon, commonName=Amazon RSA 4096 M05
- Issuer: countryName=US, organizationName=Amazon, commonName=Amazon Root CA 2
- Serial: 07C94234B1B154A30432CC8AA056C1144C20ED
- SHA-256: 8714CD260F39B865E4B0ADF16ECBAA748AB0ABE494980E80E196A6DB1B170B5B
- SPKI SHA-256: 69262417C64D056E5EF5395F7BC65BD7C6D7C3122F5F1F40E7A6CAF9980ECE8D
- Validity: 2025-01-13 to 2033-01-13
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-01.r1.ica.amazontrust.com/crl/1dccc30c-ec9c-4c75-bc6a-eed04fb1a10f.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.rootca2.amazontrust.com
- CRL DP: http://crl.rootca2.amazontrust.com/rootca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:c9:42:34:b1:b1:54:a3:04:32:cc:8a:a0:56:c1:14:4c:20:ed
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Amazon, CN = Amazon Root CA 2
        Validity
            Not Before: Jan 13 23:53:55 2025 GMT
            Not After : Jan 13 23:53:55 2033 GMT
        Subject: C = US, O = Amazon, CN = Amazon RSA 4096 M05
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                FD:AE:5C:76:4E:6F:33:88:2D:8E:66:87:7A:D2:63:42:7A:64:99:9D
            X509v3 Authority Key Identifier:
                B0:0C:F0:4C:30:F4:05:58:02:48:FD:33:E5:52:AF:4B:84:E3:66:52
            Authority Information Access:
                OCSP - URI:http://ocsp.rootca2.amazontrust.com
                CA Issuers - URI:http://crt.rootca2.amazontrust.com/rootca2.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.rootca2.amazontrust.com/rootca2.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 8714CD260F39B865E4B0ADF16ECBAA748AB0ABE494980E80E196A6DB1B170B5B
    SPKI SHA256: 69262417C64D056E5EF5395F7BC65BD7C6D7C3122F5F1F40E7A6CAF9980ECE8D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.rootca2.amazontrust.com
- AIA CA Issuers: http://crt.rootca2.amazontrust.com/rootca2.cer
- CRL Distribution Points: http://crl.rootca2.amazontrust.com/rootca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
