# CA Owner Audit Dump - Asseco Data Systems S.A.

Generated: 2026-07-28T06:44:03.274711Z

## CA Owner Summary

- Name: Asseco Data Systems S.A.
- Country: Polska
- Website: -
- Problem Reporting: https://problemreport.certum.pl/
- CP/CPS URLs: https://www.certum.eu/en/wp-content/uploads/2025/11/Certification-Policy-of-Certum-Certification-Services_v5.2.pdf, https://www.certum.eu/en/wp-content/uploads/2026/05/Certification-Practice-Statement-of-Certum-Certification-Services_v8.4.pdf, https://repository.certum.pl/cp-cps-tls/certum-cp-cps-tls-certificates-en-1-0-1.pdf, https://repository.certum.pl/cp-cps-tls/certum-cp-cps-tls-certificates-en-1-0-1.md, https://legal.ssl.com/documents/SSLcom-CP-CPS-v1.16.pdf, https://repository.trustasia.com/repo/cps/TrustAsia-Global-CP-CPS_EN_V2.1.3.pdf, https://repository.trustasia.com/repo/cps/adoc/TrustAsia-Global-CP-CPS_EN_V2.1.3.adoc, https://assets-cdn.sheca.com/documents/CP-CPS-TLS-v1.4.md, https://assets-cdn.sheca.com/documents/SHECA-EV-CP-v1.6.8.pdf, https://assets-cdn.sheca.com/documents/SHECA-EV%20CPS-v1.5.2.pdf, https://assets-cdn.sheca.com/documents/UniTrust%20Certificate%20Policy%20v1.5.1%EF%BC%88EN%20)%20%20.pdf, https://assets-cdn.sheca.com/documents/UniTrust%20Certification%20Practice%20Statement%20v3.7.3%EF%BC%88EN%EF%BC%89.pdf
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=84a61b66-db2a-4a62-a227-ea3624e52f3e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=55c7a16e-283a-4bf2-8e88-3f716fff5cea, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a23fcf5d-bdb5-45d3-abbb-2b230214f989, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7799eaad-dd3c-489b-9dd1-21c5c1c6046c, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5071ae66-985b-4eba-81c0-ee2df7f0a57b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c175793c-60ed-4c70-8bf7-f875050e202a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4abb6f0c-a72d-40ca-90a1-1c40b140f75a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=46752846-7d64-424d-bdf4-9aba8564e584, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=adbc8c7c-930a-4dee-bcbf-b927ae2c5b3a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f8559916-8dae-43bb-a3f3-2c8b27315707, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=232d854a-3ab9-45f9-b85d-21b0e9221e14, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=502c0aa5-0649-452f-ab45-eea59a6a07cd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=76914bf6-9b3a-4c5f-b739-419a1152c6ca, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=411bce13-7fd2-46bf-a31b-b3cec80e9ff9, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=24fb8c97-6794-4ea5-9edf-08bf1d9dfb94, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1f1ac968-90bb-425a-a8d4-9145ce4fbe85, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f53cdfff-2713-4ae6-9911-188399a81304, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1fe4900e-4628-4179-84fe-03cc0ed9698f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=182b8855-b43b-49b3-bde1-74cd62e1a554, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=97e2e70c-8858-48f2-86db-3512a420cd88, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=aec0f290-c328-4680-aa32-b9940b2efddd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2864cf32-d9e2-4707-9b59-3690fa197ada, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=adab9973-2cd3-418c-867b-bc9f1b7130a5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=19c9c7f1-f266-4590-af26-5dd966d42501, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1dae9bf9-b4c3-49f1-a5b5-3f38d848bab5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=8fb4576e-f39d-49b3-b4f5-e40e022f1f61, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6f3a3b25-e395-4d37-a246-5577eb4c77dd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=aa03f908-bde8-4967-81da-8c91029f87d9, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c9a45b2a-d5e1-4127-b20a-fce6677ca840
- Root Programs: {"mozilla":"Included","chrome":"Not Included","microsoft":"Included","apple":"Included"}

## Owner Disclosure Snapshot

- Problem reporting mechanism: https://problemreport.certum.pl/
- CP/CPS URLs: https://www.certum.eu/en/wp-content/uploads/2025/11/Certification-Policy-of-Certum-Certification-Services_v5.2.pdf, https://www.certum.eu/en/wp-content/uploads/2026/05/Certification-Practice-Statement-of-Certum-Certification-Services_v8.4.pdf, https://repository.certum.pl/cp-cps-tls/certum-cp-cps-tls-certificates-en-1-0-1.pdf, https://repository.certum.pl/cp-cps-tls/certum-cp-cps-tls-certificates-en-1-0-1.md, https://legal.ssl.com/documents/SSLcom-CP-CPS-v1.16.pdf, https://repository.trustasia.com/repo/cps/TrustAsia-Global-CP-CPS_EN_V2.1.3.pdf, https://repository.trustasia.com/repo/cps/adoc/TrustAsia-Global-CP-CPS_EN_V2.1.3.adoc, https://assets-cdn.sheca.com/documents/CP-CPS-TLS-v1.4.md, https://assets-cdn.sheca.com/documents/SHECA-EV-CP-v1.6.8.pdf, https://assets-cdn.sheca.com/documents/SHECA-EV%20CPS-v1.5.2.pdf, https://assets-cdn.sheca.com/documents/UniTrust%20Certificate%20Policy%20v1.5.1%EF%BC%88EN%20)%20%20.pdf, https://assets-cdn.sheca.com/documents/UniTrust%20Certification%20Practice%20Statement%20v3.7.3%EF%BC%88EN%EF%BC%89.pdf
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=84a61b66-db2a-4a62-a227-ea3624e52f3e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=55c7a16e-283a-4bf2-8e88-3f716fff5cea, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a23fcf5d-bdb5-45d3-abbb-2b230214f989, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7799eaad-dd3c-489b-9dd1-21c5c1c6046c, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5071ae66-985b-4eba-81c0-ee2df7f0a57b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c175793c-60ed-4c70-8bf7-f875050e202a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4abb6f0c-a72d-40ca-90a1-1c40b140f75a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=46752846-7d64-424d-bdf4-9aba8564e584, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=adbc8c7c-930a-4dee-bcbf-b927ae2c5b3a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f8559916-8dae-43bb-a3f3-2c8b27315707, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=232d854a-3ab9-45f9-b85d-21b0e9221e14, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=502c0aa5-0649-452f-ab45-eea59a6a07cd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=76914bf6-9b3a-4c5f-b739-419a1152c6ca, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=411bce13-7fd2-46bf-a31b-b3cec80e9ff9, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=24fb8c97-6794-4ea5-9edf-08bf1d9dfb94, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1f1ac968-90bb-425a-a8d4-9145ce4fbe85, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f53cdfff-2713-4ae6-9911-188399a81304, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1fe4900e-4628-4179-84fe-03cc0ed9698f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=182b8855-b43b-49b3-bde1-74cd62e1a554, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=97e2e70c-8858-48f2-86db-3512a420cd88, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=aec0f290-c328-4680-aa32-b9940b2efddd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2864cf32-d9e2-4707-9b59-3690fa197ada, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=adab9973-2cd3-418c-867b-bc9f1b7130a5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=19c9c7f1-f266-4590-af26-5dd966d42501, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1dae9bf9-b4c3-49f1-a5b5-3f38d848bab5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=8fb4576e-f39d-49b3-b4f5-e40e022f1f61, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6f3a3b25-e395-4d37-a246-5577eb4c77dd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=aa03f908-bde8-4967-81da-8c91029f87d9, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c9a45b2a-d5e1-4127-b20a-fce6677ca840
- Repository URLs: https://www.certum.pl/pl/cert_wiedza_repozytorium_pl_en/, https://www.ssl.com/repository/, https://www.sheca.com/repository
- Root programs: {"mozilla":"Included","chrome":"Not Included","microsoft":"Included","apple":"Included"}
- Contact aliases: -

## Certificate Inventory

| # | Subject | CA | Lifecycle | Validity | Policies | pathLen | EKU | zlint |
|---|---|---|---|---|---|---|---|---|
| 1 | countryName=PL, organizationName=Unizeto Sp. z o.o., commonName=Certum CA | yes | unknown | 2002-06-11 to 2027-06-11 | - | - | - | current errors: 3 |
| 2 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Code Signing ECC Root CA | yes | unknown | 2023-01-27 to 2048-01-26 | - | - | - | clean |
| 3 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Code Signing RSA Root CA | yes | unknown | 2023-01-27 to 2048-01-26 | - | - | - | clean |
| 4 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Document Signing ECC Root CA | yes | unknown | 2023-01-27 to 2048-01-26 | - | - | - | clean |
| 5 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Document Signing RSA Root CA | yes | unknown | 2023-01-27 to 2048-01-26 | - | - | - | clean |
| 6 | countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum EC-384 CA | yes | unknown | 2018-03-26 to 2043-03-26 | - | - | - | clean |
| 7 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum SMIME ECC Root CA | yes | unknown | 2023-01-27 to 2048-01-26 | - | - | - | clean |
| 8 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum SMIME RSA Root CA | yes | unknown | 2023-01-27 to 2048-01-26 | - | - | - | clean |
| 9 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS ECC Root CA | yes | unknown | 2023-01-27 to 2048-01-26 | - | - | - | clean |
| 10 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS RSA Root CA | yes | unknown | 2023-01-27 to 2048-01-26 | - | - | - | clean |
| 11 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA | yes | unknown | 2008-10-22 to 2029-12-31 | - | - | - | clean |
| 12 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA 2 | yes | unknown | 2011-10-06 to 2046-10-06 | - | - | - | current errors: 1 |
| 13 | countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA | yes | unknown | 2018-03-16 to 2043-03-16 | - | - | - | clean |
| 14 | countryName=PL, organizationName=3S2N Sp. z o.o., organizationalUnitName=3S2N Sp. z o.o., commonName=4fastssl.com | yes | current | 2017-04-18 to 2027-04-16 | 2.5.29.32.0 | 0 | - | clean |
| 15 | countryName=UY, organizationName=Abitab S.A., organizationalUnitName=IDdigital, commonName=Abitab SSL Domain Validated | yes | current | 2018-08-22 to 2027-05-02 | 2.5.29.32.0 | 0 | - | clean |
| 16 | countryName=UY, organizationName=Abitab S.A., organizationalUnitName=IDdigital, commonName=Abitab SSL Extended Validation | yes | current | 2018-08-22 to 2027-05-02 | 2.5.29.32.0 | 0 | - | clean |
| 17 | countryName=UY, organizationName=Abitab S.A., organizationalUnitName=IDdigital, commonName=Abitab SSL Organization Validated | yes | current | 2018-08-22 to 2027-05-02 | 2.5.29.32.0 | 0 | - | clean |
| 18 | countryName=CM, organizationName=National Agency for Information and Communication Technologies, commonName=ANTIC DV CA | yes | current | 2022-07-28 to 2027-05-31 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 19 | countryName=CN, organizationName=Anhui Spider Information Technology Co., Ltd., commonName=AnTrust OV SSL G2 R30 CA | yes | current | 2025-06-17 to 2030-06-06 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 20 | countryName=SG, organizationName=AutonTrust PTE. LTD., commonName=AutonTrust PRO DV TLS G2 R31 CA | yes | current | 2026-06-17 to 2031-06-06 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 21 | countryName=CN, organizationName=WoSign CA Limited, commonName=Certification Authority of WoSign G2 | yes | revoked, expired | 2012-01-01 to 2020-11-02 | 2.5.29.32.0 | 2 | - | historical errors: 1 |
| 22 | countryName=CN, organizationName=WoSign CA Limited, commonName=Certification Authority of WoSign G2 | yes | revoked, expired | 2012-02-01 to 2020-11-02 | 2.5.29.32.0 | 2 | - | historical errors: 2 |
| 23 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Class I CA | yes | revoked, expired | 2009-04-25 to 2024-04-25 | 2.5.29.32.0 | - | - | clean |
| 24 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Class I CA | yes | current | 2013-01-24 to 2028-01-24 | 2.5.29.32.0 | - | - | current errors: 1 |
| 25 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Class I CA | yes | expired | 2009-04-25 to 2024-04-25 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 26 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Class I CA SHA2 | yes | current | 2014-09-11 to 2027-06-09 | 2.5.29.32.0 | - | - | clean |
| 27 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Client Authentication G2 E40 CA | yes | current | 2025-06-17 to 2040-06-03 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 28 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Code Signing 2021 CA | yes | current | 2021-05-19 to 2036-05-18 | 2.5.29.32.0 | - | Code Signing | clean |
| 29 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Code Signing CA | yes | current | 2013-01-24 to 2028-01-24 | 2.5.29.32.0 | - | Code Signing | current errors: 1 |
| 30 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Code Signing CA | yes | revoked | 2011-09-20 to 2026-09-20 | 2.5.29.32.0 | - | Code Signing | historical errors: 1 |
| 31 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Code Signing CA | yes | revoked | 2011-09-20 to 2026-09-20 | 2.5.29.32.0 | - | Code Signing | clean |
| 32 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Code Signing CA SHA2 | yes | current | 2015-10-29 to 2027-06-09 | 2.5.29.32.0 | - | Code Signing | clean |
| 33 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Digital Identification CA SHA2 | yes | current | 2015-04-21 to 2027-06-09 | 2.5.29.32.0 | - | - | clean |
| 34 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Document Signing G2 R40 CA | yes | current | 2025-06-17 to 2040-06-03 | 2.5.29.32.0 | 0 | 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12, 1.3.6.1.5.5.7.3.36 | clean |
| 35 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Domain Validation CA SHA2 | yes | current | 2014-09-11 to 2027-06-09 | 2.5.29.32.0 | - | - | clean |
| 36 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum DV TLS G2 E39 CA | yes | current | 2024-06-18 to 2039-06-05 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 37 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum DV TLS G2 R39 CA | yes | current | 2024-06-18 to 2039-06-05 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 38 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum DV TLS G3 E39 CA | yes | current | 2024-04-02 to 2039-03-20 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 39 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum DV TLS G3 R39 CA | yes | current | 2024-04-02 to 2039-03-20 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 40 | countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum EC-384 CA | yes | current | 2023-09-19 to 2028-09-19 | 2.5.29.32.0 | - | - | current errors: 2 |
| 41 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum EV TLS G2 E39 CA | yes | current | 2024-06-18 to 2039-06-05 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 42 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum EV TLS G2 R39 CA | yes | current | 2024-06-18 to 2039-06-05 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 43 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum EV TLS G3 E39 CA | yes | current | 2024-04-02 to 2039-03-20 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 44 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum EV TLS G3 R39 CA | yes | current | 2024-04-02 to 2039-03-20 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 45 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Extended Validation CA | yes | current | 2013-01-24 to 2028-01-24 | 2.5.29.32.0 | - | - | current errors: 1 |
| 46 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Extended Validation CA | yes | revoked, expired | 2009-12-03 to 2024-12-03 | 2.5.29.32.0 | 0 | - | clean |
| 47 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Extended Validation CA | yes | expired | 2009-12-03 to 2024-12-03 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 48 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Extended Validation CA | yes | expired | 2009-03-04 to 2019-03-04 | 2.5.29.32.0 | 0 | - | clean |
| 49 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Extended Validation CA SHA2 | yes | current | 2014-09-11 to 2027-06-09 | 2.5.29.32.0 | - | - | clean |
| 50 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Extended Validation Code Signing 2021 CA | yes | current | 2021-05-19 to 2036-05-18 | 2.5.29.32.0 | - | Code Signing | clean |
| 51 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Extended Validation Code Signing CA SHA2 | yes | current | 2015-10-29 to 2027-01-19 | 2.5.29.32.0 | - | Code Signing | clean |
| 52 | countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Extended Validation ECC CA | yes | current | 2019-10-17 to 2034-10-17 | 2.5.29.32.0 | - | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 53 | countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Extended Validation RSA CA | yes | current | 2019-10-17 to 2034-10-17 | 2.5.29.32.0 | - | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 54 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA | yes | expired | 2009-03-03 to 2024-03-03 | 2.5.29.32.0 | - | - | historical errors: 2 |
| 55 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA | yes | revoked, expired | 2009-03-03 to 2024-03-03 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 56 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2 | yes | current | 2014-09-11 to 2027-06-09 | 2.5.29.32.0 | - | - | clean |
| 57 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Global Services SMIME RSA CA | yes | current | 2023-08-08 to 2038-07-30 | 2.5.29.32.0 | - | E-mail Protection, TLS Web Client Authentication | clean |
| 58 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum KWT G1 R29 CA | yes | current | 2026-02-18 to 2029-12-20 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 59 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Level I CA | yes | expired | 2009-03-03 to 2024-03-03 | 2.5.29.32.0 | - | - | historical errors: 2 |
| 60 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Level I CA | yes | revoked, expired | 2009-03-03 to 2024-03-03 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 61 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Level II CA | yes | expired | 2009-03-03 to 2024-03-03 | 2.5.29.32.0 | - | - | historical errors: 2 |
| 62 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Level II CA | yes | revoked, expired | 2009-03-03 to 2024-03-03 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 63 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Level III CA | yes | revoked, expired | 2009-03-03 to 2024-03-03 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 64 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Level III CA | yes | expired | 2009-03-03 to 2024-03-03 | 2.5.29.32.0 | - | - | historical errors: 2 |
| 65 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Level IV CA | yes | revoked, expired | 2009-03-03 to 2024-03-03 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 66 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Level IV CA | yes | expired | 2009-03-03 to 2024-03-03 | 2.5.29.32.0 | - | - | historical errors: 2 |
| 67 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Organization Validation CA SHA2 | yes | current | 2014-09-11 to 2027-06-09 | 2.5.29.32.0 | - | - | clean |
| 68 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum OV TLS G2 E39 CA | yes | current | 2024-06-18 to 2039-06-05 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 69 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum OV TLS G2 R39 CA | yes | current | 2024-06-18 to 2039-06-05 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 70 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum OV TLS G3 E39 CA | yes | current | 2024-04-02 to 2039-03-20 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 71 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum OV TLS G3 R39 CA | yes | current | 2024-04-02 to 2039-03-20 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 72 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Partners CA | yes | revoked, expired | 2009-03-03 to 2024-03-03 | 2.5.29.32.0 | - | - | clean |
| 73 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum SMIME ECC CA | yes | current | 2023-08-01 to 2038-07-23 | 2.5.29.32.0 | - | E-mail Protection, TLS Web Client Authentication | clean |
| 74 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum SMIME G1 R36 CA | yes | current | 2026-02-18 to 2036-02-06 | 2.5.29.32.0 | 0 | E-mail Protection | clean |
| 75 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum SMIME G1 R36 CA 2 | yes | current | 2026-03-05 to 2036-02-21 | 2.5.29.32.0 | - | E-mail Protection, TLS Web Client Authentication | clean |
| 76 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum SMIME RSA CA | yes | current | 2023-08-01 to 2038-07-23 | 2.5.29.32.0 | - | E-mail Protection, TLS Web Client Authentication | clean |
| 77 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Timestamping 2021 CA | yes | current | 2021-05-19 to 2036-05-18 | 2.5.29.32.0 | - | Time Stamping | clean |
| 78 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS ECC Root CA | yes | current | 2026-06-08 to 2029-12-30 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2 | - | TLS Web Server Authentication | current errors: 2 |
| 79 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS ECC Root CA | yes | current | 2026-06-08 to 2036-04-15 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2 | - | TLS Web Server Authentication | current errors: 2 |
| 80 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS ECC Root CA | yes | revoked | 2026-04-29 to 2029-12-30 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2 | - | TLS Web Server Authentication | historical errors: 2 |
| 81 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS ECC Root CA | yes | revoked | 2026-04-29 to 2036-04-15 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2 | - | TLS Web Server Authentication | historical errors: 2 |
| 82 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS RSA Root CA | yes | revoked | 2026-04-29 to 2036-04-15 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2 | - | TLS Web Server Authentication | historical errors: 1 |
| 83 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS RSA Root CA | yes | current | 2026-06-08 to 2036-04-15 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2 | - | TLS Web Server Authentication | current errors: 1 |
| 84 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS RSA Root CA | yes | current | 2026-06-08 to 2029-12-30 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2 | - | TLS Web Server Authentication | current errors: 1 |
| 85 | countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS RSA Root CA | yes | revoked | 2026-04-29 to 2029-12-30 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2 | - | TLS Web Server Authentication | historical errors: 1 |
| 86 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA | yes | expired | 2008-10-22 to 2025-12-30 | 2.5.29.32.0 | - | - | historical errors: 2 |
| 87 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA | yes | current | 2008-10-22 to 2027-06-10 | 2.5.29.32.0 | - | - | current errors: 1 |
| 88 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA | yes | revoked, expired | 2008-10-22 to 2025-12-30 | - | - | - | historical errors: 1 |
| 89 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA 2 | yes | current | 2021-05-31 to 2029-09-17 | 2.5.29.32.0 | - | - | clean |
| 90 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA 2 | yes | revoked | 2011-10-06 to 2046-10-06 | - | - | - | historical errors: 1 |
| 91 | countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA | yes | current | 2023-09-19 to 2028-09-19 | 2.5.29.32.0 | - | - | current errors: 1 |
| 92 | countryName=PL, organizationName=home.pl S.A., commonName=Certyfikat SSL | yes | expired | 2016-06-08 to 2026-06-06 | - | 0 | - | historical errors: 1 |
| 93 | countryName=CN, organizationName=China Financial Certification Authority, commonName=CFCA DV ECC CA | yes | current | 2023-12-05 to 2027-05-23 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 94 | countryName=CN, organizationName=China Financial Certification Authority, commonName=CFCA DV RSA CA | yes | current | 2023-12-05 to 2027-05-23 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 95 | countryName=CN, organizationName=China Financial Certification Authority, commonName=CFCA EV ECC CA | yes | current | 2023-12-05 to 2027-05-23 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 96 | countryName=CN, organizationName=China Financial Certification Authority, commonName=CFCA EV RSA CA | yes | current | 2023-12-05 to 2027-05-23 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 97 | countryName=CN, organizationName=China Financial Certification Authority, commonName=CFCA OV ECC CA | yes | current | 2023-12-05 to 2027-05-23 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 98 | countryName=CN, organizationName=China Financial Certification Authority, commonName=CFCA OV RSA CA | yes | current | 2023-12-05 to 2027-05-23 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 99 | countryName=CN, organizationName=Henan Fierce Fire Network Technology Co., Ltd., commonName=CNSSL DV TLS G2 R36 CA | yes | current | 2026-01-14 to 2036-01-02 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 100 | countryName=CN, organizationName=Henan Fierce Fire Network Technology Co., Ltd., commonName=CNSSL OV TLS G2 R36 CA | yes | current | 2026-02-11 to 2036-01-30 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 101 | countryName=PL, organizationName=cyber_Folks S.A., commonName=cyber_Folks | yes | revoked | 2023-03-16 to 2027-05-20 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 102 | countryName=PL, organizationName=cyber_Folks S.A., commonName=cyber_Folks | yes | current | 2023-05-15 to 2027-05-20 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 103 | countryName=CN, organizationName=Global Digital Cybersecurity Authority Co., Ltd., commonName=GDCA TrustAUTH R4 DV SSL CA G2 | yes | current | 2018-01-26 to 2027-05-20 | 2.5.29.32.0 | 0 | - | clean |
| 104 | countryName=CN, organizationName=Global Digital Cybersecurity Authority Co., Ltd., commonName=GDCA TrustAUTH R4 EV SSL CA G2 | yes | current | 2018-01-26 to 2027-05-20 | 2.5.29.32.0 | 0 | - | clean |
| 105 | countryName=CN, organizationName=Global Digital Cybersecurity Authority Co., Ltd., commonName=GDCA TrustAUTH R4 OV SSL CA G2 | yes | current | 2018-01-26 to 2027-05-20 | 2.5.29.32.0 | 0 | - | clean |
| 106 | countryName=CN, organizationName=GeoSSL, Inc., commonName=GeoSSL DV TLS CA | yes | current | 2024-12-17 to 2034-12-05 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 107 | countryName=CN, organizationName=GeoSSL, Inc., commonName=GeoSSL EV TLS CA | yes | current | 2024-12-17 to 2034-12-05 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 108 | countryName=CN, organizationName=GeoSSL, Inc., commonName=GeoSSL OV TLS CA | yes | current | 2024-12-17 to 2034-12-05 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 109 | countryName=RU, organizationName=GAZINFORMSERVICE Company limited, organizationalUnitName=CA, commonName=GIS CA | yes | expired | 2012-06-14 to 2022-06-12 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 110 | countryName=RU, organizationName=GAZINFORMSERVICE Company limited, organizationalUnitName=CA, commonName=GIS CA | yes | revoked, expired | 2012-06-14 to 2022-06-12 | 2.5.29.32.0 | 0 | - | clean |
| 111 | countryName=RU, organizationName=GAZINFORMSERVICE Company limited, organizationalUnitName=CA, commonName=GIS CA | yes | expired | 2014-09-30 to 2024-09-27 | - | 0 | - | historical errors: 1 |
| 112 | countryName=RU, organizationName=GAZINFORMSERVICE Company limited, organizationalUnitName=CA, commonName=GIS CA | yes | revoked, expired | 2011-10-10 to 2021-10-07 | 2.5.29.32.0 | 0 | - | clean |
| 113 | countryName=LV, organizationName=EnVers Group SIA, organizationalUnitName=GoGetSSL Certification Authority, commonName=GoGetSSL Business Validation CA SHA2 | yes | current | 2018-01-26 to 2027-05-20 | 2.5.29.32.0 | 0 | - | clean |
| 114 | countryName=LV, organizationName=EnVers Group SIA, organizationalUnitName=GoGetSSL Certification Authority, commonName=GoGetSSL Domain Validation CA SHA2 | yes | current | 2018-01-26 to 2027-05-20 | 2.5.29.32.0 | 0 | - | clean |
| 115 | countryName=LV, organizationName=EnVers Group SIA, organizationalUnitName=GoGetSSL Certification Authority, commonName=GoGetSSL Extended Validation CA SHA2 | yes | current | 2018-01-26 to 2027-05-20 | 2.5.29.32.0 | 0 | - | clean |
| 116 | countryName=PL, organizationName=home.pl S.A., commonName=home pl DV TLS G2 R35 CA | yes | current | 2025-05-28 to 2035-05-16 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 117 | countryName=PL, organizationName=home.pl sp. z o.o., commonName=home pl DV TLS G2 R36 CA | yes | current | 2026-01-14 to 2036-01-02 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 118 | countryName=PL, organizationName=home.pl S.A., commonName=home pl OV TLS G2 R35 CA | yes | current | 2025-05-28 to 2035-05-16 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 119 | countryName=PL, organizationName=home.pl sp. z o.o., commonName=home pl OV TLS G2 R36 CA | yes | current | 2026-01-14 to 2036-01-02 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 120 | countryName=AT, organizationName=IKARUS Security Software GmbH, commonName=IKARUS mail.security | yes | current | 2023-08-08 to 2028-08-01 | 2.23.140.1.5.1.2, 2.23.140.1.5.1.3 | - | E-mail Protection, TLS Web Client Authentication | clean |
| 121 | countryName=AT, organizationName=IKARUS Security Software GmbH, commonName=IKARUS mail.security | yes | current | 2023-06-13 to 2027-05-20 | 2.5.29.32.0 | 0 | E-mail Protection | clean |
| 122 | countryName=AT, organizationName=IKARUS Security GmbH, commonName=IKARUS mail.security SMIME G1 R36 CA | yes | current | 2026-05-06 to 2036-04-23 | 2.5.29.32.0 | - | E-mail Protection, TLS Web Client Authentication | clean |
| 123 | countryName=CN, organizationName=iTrust, Inc, commonName=iTrust DV TLS CA | yes | current | 2025-01-15 to 2035-01-03 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 124 | countryName=CN, organizationName=iTrust, Inc, commonName=iTrust OV TLS CA | yes | current | 2025-01-15 to 2035-01-03 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 125 | countryName=CN, organizationName=JoySSL Limited, commonName=JoySSL DV TLS G2 R33 CA | yes | current | 2024-08-20 to 2033-08-08 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 126 | countryName=CN, organizationName=JoySSL Limited, commonName=JoySSL OV TLS G2 R33 CA | yes | current | 2024-08-20 to 2033-08-08 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 127 | countryName=PL, organizationName=LH.pl Sp. z o.o., commonName=LH.pl CA | yes | current | 2024-01-02 to 2027-05-11 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 128 | countryName=PL, organizationName=nazwa.pl S.A., organizationalUnitName=http://nazwa.pl, commonName=nazwaSSL | yes | expired | 2014-05-06 to 2022-07-04 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 129 | countryName=PL, organizationName=nazwa.pl S.A., organizationalUnitName=http://nazwa.pl, commonName=nazwaSSL | yes | expired | 2014-09-30 to 2024-09-27 | - | 0 | - | historical errors: 1 |
| 130 | countryName=PL, organizationName=NetArt Spółka Akcyjna S.K.A., organizationalUnitName=http://nazwa.pl, commonName=nazwaSSL | yes | revoked, expired | 2012-04-26 to 2022-04-24 | 2.5.29.32.0 | 0 | - | clean |
| 131 | countryName=PL, organizationName=NetArt SpÃ³Åka Akcyjna S.K.A., organizationalUnitName=http://nazwa.pl, commonName=nazwaSSL | yes | expired | 2012-07-06 to 2022-07-04 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 132 | countryName=PL, organizationName=nazwa.pl sp. z o.o., organizationalUnitName=http://nazwa.pl, commonName=nazwaSSL | yes | expired | 2015-12-31 to 2025-12-28 | - | 0 | - | historical errors: 1 |
| 133 | nazwaSSL | yes | revoked, expired | 2012-07-06 to 2022-07-04 | - | - | - | clean |
| 134 | countryName=PL, organizationName=nazwa.pl Sp. z o.o., commonName=nazwaSSL DV TLS G2 E29 CA | yes | current | 2024-08-20 to 2029-08-14 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 135 | countryName=PL, organizationName=nazwa.pl Sp. z o.o., commonName=nazwaSSL DV TLS G2 R29 CA | yes | current | 2024-08-20 to 2029-08-14 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 136 | countryName=PL, organizationName=netart.com sp. z o.o., commonName=netartSSL | yes | current | 2023-05-10 to 2027-05-20 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 137 | countryName=PL, organizationName=netart.com sp. z o.o., commonName=netartSSL | yes | revoked | 2023-01-23 to 2027-05-20 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 138 | countryName=PL, organizationName=netart.com sp. z o.o., commonName=netartSSL DV TLS G2 E31 CA | yes | current | 2026-06-17 to 2031-06-06 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | current errors: 1 |
| 139 | countryName=US, organizationName=NYA LABS LLC, commonName=Nya Labs CA | yes | current | 2023-11-02 to 2027-05-22 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 140 | countryName=CA, organizationName=Nyatwork Communication Ltd, commonName=Nyatwork | yes | current | 2021-10-19 to 2026-10-19 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 141 | countryName=CN, organizationName=Kingnet Information Technology Co., Ltd., organizationalUnitName=Kingnettech, commonName=OKCERT R4 DV SSL CA G2 | yes | current | 2019-06-12 to 2027-05-21 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 142 | countryName=CN, organizationName=Kingnet Information Technology Co., Ltd., organizationalUnitName=Kingnettech, commonName=OKCERT R4 EV SSL CA G2 | yes | current | 2019-06-12 to 2027-05-21 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 143 | countryName=CN, organizationName=Kingnet Information Technology Co., Ltd., organizationalUnitName=Kingnettech, commonName=OKCERT R4 OV SSL CA G2 | yes | current | 2019-06-12 to 2027-05-21 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 144 | countryName=TR, organizationName=Ondokuzon Yazilim AS, commonName=Onmime SMIME G1 R36 CA | yes | current | 2026-02-11 to 2036-01-30 | 2.5.29.32.0 | 0 | E-mail Protection | clean |
| 145 | countryName=CN, organizationName=Suzhou Qiduo Information Technology Co., Ltd., organizationalUnitName=Domain Validated SSL, commonName=QIDUOCA 2018 DV SSL | yes | current | 2018-08-22 to 2027-05-02 | 2.5.29.32.0 | 0 | - | clean |
| 146 | countryName=US, organizationName=Root Networks, LLC, commonName=Root CA - G3 | yes | revoked | 2020-09-09 to 2028-09-09 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 147 | countryName=US, organizationName=Root Networks, LLC, commonName=Root Global CA - G2 | yes | current | 2020-01-30 to 2027-05-20 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 148 | countryName=US, organizationName=Root Networks, LLC, commonName=Root Networks CA | yes | current | 2023-05-15 to 2028-09-09 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 149 | countryName=PL, organizationName=Shoper S.A., commonName=Shoper DV TLS G2 R34 CA | yes | current | 2024-05-28 to 2034-05-16 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 150 | countryName=PL, organizationName=Dreamcommerce S.A., organizationalUnitName=Dreamcommerce S.A., commonName=Shoper® SSL | yes | expired | 2014-09-30 to 2024-09-27 | - | 0 | - | historical errors: 1 |
| 151 | countryName=PL, organizationName=Dreamcommerce S.A., organizationalUnitName=Dreamcommerce S.A., commonName=ShoperÂ® SSL | yes | expired | 2012-06-15 to 2022-06-13 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 152 | Shoper® SSL | yes | revoked, expired | 2012-06-15 to 2022-06-13 | - | - | - | clean |
| 153 | countryName=CN, organizationName=Shanghai Ping An Credit Reference Company Limited, commonName=Shuidi Webtrust SSL Domain Validated | yes | current | 2019-02-07 to 2027-05-21 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 154 | countryName=CN, organizationName=Shanghai Ping An Credit Reference Company Limited, commonName=Shuidi Webtrust SSL Extended Validated | yes | current | 2019-02-07 to 2027-05-21 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 155 | countryName=CN, organizationName=Shanghai Ping An Credit Reference Company Limited, commonName=Shuidi Webtrust SSL Organization Validated | yes | current | 2019-02-07 to 2027-05-21 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 156 | countryName=PT, organizationName=Sooma.com Web Services Lda, commonName=Sooma Digital Trust Validation | yes | current | 2023-01-23 to 2027-05-20 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 157 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=SpaceSSL Certification Authority, commonName=SpaceSSL CA | yes | expired | 2014-04-16 to 2024-03-02 | - | 0 | - | historical errors: 1 |
| 158 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=SpaceSSL Certification Authority, commonName=SpaceSSL CA | yes | revoked, expired | 2014-03-14 to 2024-03-11 | - | 0 | - | historical errors: 1 |
| 159 | countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=SpaceSSL Certification Authority, commonName=SpaceSSL CA | yes | expired | 2014-09-30 to 2024-09-27 | - | 0 | - | historical errors: 1 |
| 160 | countryName=GB, organizationName=SSL Limited, commonName=SSL Secure Site CA | yes | current | 2022-09-29 to 2027-09-28 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 161 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2 | yes | expired | 2018-09-11 to 2023-09-11 | 2.5.29.32.0 | 2 | - | clean |
| 162 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA | yes | expired | 2018-09-11 to 2023-09-11 | 2.5.29.32.0 | 2 | - | clean |
| 163 | countryName=CN, organizationName=Shenzhen Digital Certificate Authority Center Co., Ltd, commonName=SZCA DV SSL CA | yes | current | 2019-07-16 to 2027-05-21 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 164 | countryName=CN, organizationName=Shenzhen Digital Certificate Authority Center Co., Ltd, commonName=SZCA EV SSL CA | yes | current | 2019-07-16 to 2027-05-21 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 165 | countryName=CN, organizationName=Shenzhen Digital Certificate Authority Center Co., Ltd, commonName=SZCA OV SSL CA | yes | current | 2019-07-16 to 2027-05-21 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 166 | countryName=CN, organizationName=泰尔认证中心有限公司, commonName=TLC DV TLS CA | yes | current | 2024-12-17 to 2034-12-05 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 167 | countryName=CN, organizationName=泰尔认证中心有限公司, commonName=TLC EV TLS CA | yes | current | 2024-12-17 to 2034-12-05 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 168 | countryName=CN, organizationName=泰尔认证中心有限公司, commonName=TLC OV TLS CA | yes | current | 2024-12-17 to 2034-12-05 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 169 | countryName=CN, organizationName=TrustAsia Technologies Inc., commonName=TrustAsia DV SSL CA - C3 | yes | current | 2017-10-23 to 2027-05-14 | 2.5.29.32.0 | 0 | - | clean |
| 170 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia DV TLS RSA CA C5 | yes | current | 2025-01-15 to 2035-01-03 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 171 | countryName=CN, organizationName=TrustAsia Technologies Inc., commonName=TrustAsia EV SSL CA - C3 | yes | current | 2017-10-23 to 2027-05-14 | 2.5.29.32.0 | 0 | - | clean |
| 172 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS ECC CA C5 | yes | current | 2025-01-15 to 2035-01-03 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | current errors: 1 |
| 173 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS RSA CA C5 | yes | current | 2025-01-15 to 2035-01-03 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 174 | countryName=CN, organizationName=TrustAsia Technologies Inc., commonName=TrustAsia OV SSL CA - C3 | yes | current | 2017-10-23 to 2027-05-14 | 2.5.29.32.0 | 0 | - | clean |
| 175 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia OV TLS ECC CA C5 | yes | current | 2025-01-15 to 2035-01-03 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | current errors: 1 |
| 176 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia OV TLS RSA CA C5 | yes | current | 2025-01-15 to 2035-01-03 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 177 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia SMIME CA 2025 | yes | current | 2025-01-15 to 2035-01-03 | 2.5.29.32.0 | 0 | E-mail Protection | clean |
| 178 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA | yes | current | 2025-10-07 to 2029-01-14 | 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.1, 1.3.6.1.4.1.44494.2.1.1 | 2 | TLS Web Server Authentication | current errors: 2 |
| 179 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA | yes | current | 2025-10-07 to 2029-01-14 | 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.1, 1.3.6.1.4.1.44494.2.1.1 | 2 | TLS Web Server Authentication | current errors: 1 |
| 180 | countryName=MY, organizationName=MSC Trustgate.com Sdn. Bhd., commonName=Trustgate SMIME G2 E31 CA | yes | current | 2026-05-27 to 2031-05-16 | 2.5.29.32.0 | - | E-mail Protection, TLS Web Client Authentication | clean |
| 181 | countryName=CN, organizationName=QiaoKr Corporation Limited, commonName=TrustOcean Certification Authority | yes | current | 2017-10-23 to 2027-05-14 | 2.5.29.32.0 | 0 | - | clean |
| 182 | countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root | yes | current | 2024-01-08 to 2029-01-06 | 2.23.140.1.2.2 | 1 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 183 | countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root | yes | current | 2024-01-08 to 2029-01-06 | 2.23.140.1.2.1 | 1 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 184 | countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root | yes | revoked, expired | 2020-02-21 to 2025-02-21 | 2.5.29.32.0 | 1 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 185 | countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root | yes | expired | 2023-03-28 to 2025-02-21 | 2.23.140.1.2.1, 2.23.140.1.2.2 | 1 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 186 | countryName=DE, organizationName=United SSL Deutschland GmbH, commonName=United Trust | yes | current | 2021-02-24 to 2027-05-31 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 187 | countryName=CN, organizationName=iTrusChina Co., Ltd., commonName=vTrus DV SSL CA G1 | yes | expired | 2019-12-20 to 2024-12-20 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 188 | countryName=CN, organizationName=iTrusChina Co., Ltd., commonName=vTrus DV SSL CA G2 | yes | current | 2023-12-07 to 2027-05-25 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 189 | countryName=CN, organizationName=iTrusChina Co., Ltd., commonName=vTrus OV SSL CA G1 | yes | expired | 2019-12-20 to 2024-12-20 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 190 | countryName=CN, organizationName=iTrusChina Co., Ltd., commonName=vTrus OV SSL CA G2 | yes | current | 2023-12-07 to 2027-05-25 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 191 | countryName=US, organizationName=WhiteSSL, LLC, commonName=WhiteSSL DV TLS G2 E36 CA | yes | current | 2026-01-14 to 2036-01-02 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | current errors: 1 |
| 192 | countryName=CN, organizationName=WoSign CA Limited, commonName=WoSign Code Signing CA | yes | current | 2016-11-09 to 2026-11-09 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 193 | countryName=CN, organizationName=WoSign CA Limited, commonName=WoSign DV SSL CA | yes | current | 2017-05-18 to 2027-05-18 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 194 | countryName=CN, organizationName=WoSign CA Limited, commonName=WoSign EV SSL CA | yes | current | 2016-11-10 to 2026-11-10 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 195 | countryName=CN, organizationName=WoSign CA Limited, commonName=WoSign OV SSL CA | yes | current | 2016-11-09 to 2026-11-09 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 196 | countryName=CN, organizationName=WoTrus CA Limited, commonName=WoTrus Code Signing 2021 CA | yes | current | 2021-05-26 to 2027-05-18 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 197 | countryName=CN, organizationName=WoTrus CA Limited, commonName=WoTrus Code Signing CA | yes | current | 2018-04-17 to 2027-05-18 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 198 | countryName=CN, organizationName=WoTrus CA Limited, commonName=WoTrus DV SSL CA | yes | current | 2018-04-17 to 2027-05-18 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 199 | countryName=CN, organizationName=WoTrus CA Limited, commonName=WoTrus EV SSL CA | yes | current | 2018-04-17 to 2027-05-18 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 200 | countryName=CN, organizationName=WoTrus CA Limited, commonName=WoTrus OV SSL CA | yes | current | 2018-04-17 to 2027-05-18 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 201 | countryName=PL, organizationName=LH.pl Sp. z o.o., organizationalUnitName=LH.pl, commonName=www.lh.pl | yes | expired | 2015-01-28 to 2025-01-25 | - | 0 | - | historical errors: 1 |
| 202 | countryName=CN, organizationName=Beijing Xinchacha Credit Management Co., Ltd., commonName=Xcc Trust DV SSL CA | yes | current | 2022-07-01 to 2027-06-30 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 203 | countryName=CN, organizationName=Beijing Xinchacha Credit Management Co., Ltd., commonName=Xcc Trust OV SSL CA | yes | current | 2022-07-01 to 2027-06-30 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 204 | countryName=CN, organizationName=Beijing Xinchacha Credit Management Co., Ltd., commonName=XinChaCha Trust DV TLS G2 R34 CA | yes | current | 2024-05-28 to 2034-05-16 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 205 | countryName=CN, organizationName=Beijing Xinchacha Credit Management Co., Ltd., commonName=XinChaCha Trust EV TLS G2 R34 CA | yes | current | 2024-05-28 to 2034-05-16 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 206 | countryName=CN, organizationName=Beijing Xinchacha Credit Management Co., Ltd., commonName=XinChaCha Trust OV TLS G2 R34 CA | yes | current | 2024-05-28 to 2034-05-16 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 207 | countryName=CN, organizationName=Beijing Xinchacha Credit Management Co., Ltd., commonName=XinChaCha Trust SSL Domain Validated | yes | expired | 2020-05-18 to 2025-05-18 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 208 | countryName=CN, organizationName=Beijing Xinchacha Credit Management Co., Ltd., commonName=XinChaCha Trust SSL Extended Validated | yes | expired | 2020-05-18 to 2025-05-18 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 209 | countryName=CN, organizationName=Beijing Xinchacha Credit Management Co., Ltd., commonName=XinChaCha Trust SSL Organization Validated | yes | expired | 2020-05-18 to 2025-05-18 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 210 | countryName=CN, organizationName=Xin Net Technology Corp., commonName=XinNet DV TLS CA | yes | current | 2024-12-17 to 2034-12-05 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 211 | countryName=CN, organizationName=Xin Net Technology Corp., commonName=XinNet EV TLS CA | yes | current | 2024-12-17 to 2034-12-05 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 212 | countryName=CN, organizationName=Xin Net Technology Corp., commonName=XinNet OV TLS CA | yes | current | 2024-12-17 to 2034-12-05 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 213 | countryName=RU, organizationName=Yandex LLC, organizationalUnitName=Yandex Certification Authority, commonName=Yandex CA | yes | expired | 2015-01-21 to 2025-01-18 | 2.5.29.32.0 | - | - | clean |
| 214 | countryName=IR, organizationName=Pardazeshgaran Shahr Hooshmand Yekta Co., commonName=Yekta Domain Validated SSL CA 1 | yes | current | 2021-01-20 to 2027-05-31 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 215 | countryName=IR, organizationName=Pardazeshgaran Shahr Hooshmand Yekta Co., commonName=Yekta Organization Validated SSL CA 1 | yes | current | 2021-01-20 to 2027-05-31 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 216 | countryName=CN, organizationName=广东堡塔安全技术有限公司, commonName=宝塔 DV TLS CA | yes | current | 2025-01-15 to 2035-01-03 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |

## Certificate Details

### Certum CA

- Subject: countryName=PL, organizationName=Unizeto Sp. z o.o., commonName=Certum CA
- Issuer: countryName=PL, organizationName=Unizeto Sp. z o.o., commonName=Certum CA
- Serial: 010020
- SHA-256: D8E0FEBC1DB2E38D00940F37D27D41344D993E734B99D5656D9778D4D8143624
- SPKI SHA-256: 9736AC3B25D16C45A45418A964578156480A8CC434541DDC5DD59233229868DE
- Validity: 2002-06-11 to 2027-06-11
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.certum.eu/en/wp-content/uploads/2025/11/Certification-Policy-of-Certum-Certification-Services_v5.2.pdf, https://www.certum.eu/en/wp-content/uploads/2026/05/Certification-Practice-Statement-of-Certum-Certification-Services_v8.4.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=84a61b66-db2a-4a62-a227-ea3624e52f3e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=55c7a16e-283a-4bf2-8e88-3f716fff5cea, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a23fcf5d-bdb5-45d3-abbb-2b230214f989, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7799eaad-dd3c-489b-9dd1-21c5c1c6046c, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5071ae66-985b-4eba-81c0-ee2df7f0a57b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c175793c-60ed-4c70-8bf7-f875050e202a
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/ca.crl, http://wosign.crl.certum.eu/certumca.crl, http://wosign.repository.certum.eu/certumca.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: -
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 65568 (0x10020)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Sp. z o.o., CN = Certum CA
        Validity
            Not Before: Jun 11 10:46:39 2002 GMT
            Not After : Jun 11 10:46:39 2027 GMT
        Subject: C = PL, O = Unizeto Sp. z o.o., CN = Certum CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D8E0FEBC1DB2E38D00940F37D27D41344D993E734B99D5656D9778D4D8143624
    SPKI SHA256: 9736AC3B25D16C45A45418A964578156480A8CC434541DDC5DD59233229868DE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: -
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_key_usage_missing: 
- [current] error e_ext_subject_key_identifier_missing_ca: 
- [current] error e_root_ca_key_usage_present: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- expires_within_398_days

### Certum Code Signing ECC Root CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Code Signing ECC Root CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Code Signing ECC Root CA
- Serial: F0B6BD4ACD3428BD28A9C15F2A60769E
- SHA-256: A0E90EB2F7DD82993430BF1C4B8423473FD91D4BA494FAA5327900D9094288F1
- SPKI SHA-256: C31AA5A7266E31AF94B50F8DB9EE192EE045C3DD15F89DB522C5CE325B6C6F16
- Validity: 2023-01-27 to 2048-01-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=84a61b66-db2a-4a62-a227-ea3624e52f3e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=55c7a16e-283a-4bf2-8e88-3f716fff5cea, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c175793c-60ed-4c70-8bf7-f875050e202a
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            f0:b6:bd:4a:cd:34:28:bd:28:a9:c1:5f:2a:60:76:9e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., CN = Certum Code Signing ECC Root CA
        Validity
            Not Before: Jan 27 09:06:17 2023 GMT
            Not After : Jan 26 09:06:17 2048 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum Code Signing ECC Root CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                6D:24:B7:24:45:5F:09:F5:5E:58:EE:18:44:04:BF:23:A1:AD:11:0D
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: A0E90EB2F7DD82993430BF1C4B8423473FD91D4BA494FAA5327900D9094288F1
    SPKI SHA256: C31AA5A7266E31AF94B50F8DB9EE192EE045C3DD15F89DB522C5CE325B6C6F16
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Certum Code Signing RSA Root CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Code Signing RSA Root CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Code Signing RSA Root CA
- Serial: 546683BCC36947ADA75B95BC40804808
- SHA-256: 69BE9FCC7AD9717775969D96FF836CBDA6D15876BF758E0B7CACCB1A1BFA3B53
- SPKI SHA-256: 184367CCD4E90A9033DF430816990FCEB3FAEB0181BC167664E742AEFE3937B3
- Validity: 2023-01-27 to 2048-01-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=84a61b66-db2a-4a62-a227-ea3624e52f3e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=55c7a16e-283a-4bf2-8e88-3f716fff5cea, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c175793c-60ed-4c70-8bf7-f875050e202a
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            54:66:83:bc:c3:69:47:ad:a7:5b:95:bc:40:80:48:08
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., CN = Certum Code Signing RSA Root CA
        Validity
            Not Before: Jan 27 08:43:49 2023 GMT
            Not After : Jan 26 08:43:49 2048 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum Code Signing RSA Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                A4:73:B2:C5:E5:CD:C0:0A:FB:18:7E:CA:46:9B:7B:55:11:EC:29:11
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 69BE9FCC7AD9717775969D96FF836CBDA6D15876BF758E0B7CACCB1A1BFA3B53
    SPKI SHA256: 184367CCD4E90A9033DF430816990FCEB3FAEB0181BC167664E742AEFE3937B3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Certum Document Signing ECC Root CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Document Signing ECC Root CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Document Signing ECC Root CA
- Serial: 50DA94819C52390FC8C8D2F60585573C
- SHA-256: 89BACB86809F7A1B62097F0D81E26F8CA82261672F04B43D8799D5EB061D2EF8
- SPKI SHA-256: 6ABF44762B710D232E878022B3E0243E5A5E3334209927DDD3527AA9504DB55E
- Validity: 2023-01-27 to 2048-01-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=84a61b66-db2a-4a62-a227-ea3624e52f3e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=55c7a16e-283a-4bf2-8e88-3f716fff5cea
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            50:da:94:81:9c:52:39:0f:c8:c8:d2:f6:05:85:57:3c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., CN = Certum Document Signing ECC Root CA
        Validity
            Not Before: Jan 27 09:09:50 2023 GMT
            Not After : Jan 26 09:09:50 2048 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum Document Signing ECC Root CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                31:EC:8A:B2:40:89:B5:2C:56:50:FC:A4:BE:74:4E:CE:64:09:84:C4
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 89BACB86809F7A1B62097F0D81E26F8CA82261672F04B43D8799D5EB061D2EF8
    SPKI SHA256: 6ABF44762B710D232E878022B3E0243E5A5E3334209927DDD3527AA9504DB55E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Certum Document Signing RSA Root CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Document Signing RSA Root CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Document Signing RSA Root CA
- Serial: 4E234914946CD01BE3005799443784FE
- SHA-256: EE04DF77F179176B6B879E9D6B78C0E20C6BECA8379B0234735FA501CAD2F0BD
- SPKI SHA-256: 8562E152AEC805F341C8F37419965DC213AC6C3BC4560AB0E96187DEACFD4283
- Validity: 2023-01-27 to 2048-01-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=84a61b66-db2a-4a62-a227-ea3624e52f3e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=55c7a16e-283a-4bf2-8e88-3f716fff5cea
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4e:23:49:14:94:6c:d0:1b:e3:00:57:99:44:37:84:fe
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., CN = Certum Document Signing RSA Root CA
        Validity
            Not Before: Jan 27 08:49:00 2023 GMT
            Not After : Jan 26 08:49:00 2048 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum Document Signing RSA Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                14:E8:89:90:66:F2:47:FB:30:21:B4:37:FA:ED:1D:2B:ED:F0:BD:BF
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: EE04DF77F179176B6B879E9D6B78C0E20C6BECA8379B0234735FA501CAD2F0BD
    SPKI SHA256: 8562E152AEC805F341C8F37419965DC213AC6C3BC4560AB0E96187DEACFD4283
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Certum EC-384 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum EC-384 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum EC-384 CA
- Serial: 788F275C81125220A504D02DDDBA73F4
- SHA-256: 6B328085625318AA50D173C98D8BDA09D57E27413D114CF787A0F5D06C030CF6
- SPKI SHA-256: DE7B6932E9C44582CE0DE07ABDAB7EEA90C75D6D2A07331DF57BD5CB88553D13
- Validity: 2018-03-26 to 2043-03-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.certum.eu/en/wp-content/uploads/2025/11/Certification-Policy-of-Certum-Certification-Services_v5.2.pdf, https://www.certum.eu/en/wp-content/uploads/2026/05/Certification-Practice-Statement-of-Certum-Certification-Services_v8.4.pdf, https://repository.certum.pl/cp-cps-tls/certum-cp-cps-tls-certificates-en-1-0-1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=84a61b66-db2a-4a62-a227-ea3624e52f3e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=55c7a16e-283a-4bf2-8e88-3f716fff5cea, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a23fcf5d-bdb5-45d3-abbb-2b230214f989, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7799eaad-dd3c-489b-9dd1-21c5c1c6046c, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5071ae66-985b-4eba-81c0-ee2df7f0a57b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c175793c-60ed-4c70-8bf7-f875050e202a
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/cec384ca.crl, http://subca.crl.certum.pl/cec384ca.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:8f:27:5c:81:12:52:20:a5:04:d0:2d:dd:ba:73:f4
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum EC-384 CA
        Validity
            Not Before: Mar 26 07:24:54 2018 GMT
            Not After : Mar 26 07:24:54 2043 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum EC-384 CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                8D:06:66:74:24:76:3A:F3:89:F7:BC:D6:BD:47:7D:2F:BC:10:5F:4B
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 6B328085625318AA50D173C98D8BDA09D57E27413D114CF787A0F5D06C030CF6
    SPKI SHA256: DE7B6932E9C44582CE0DE07ABDAB7EEA90C75D6D2A07331DF57BD5CB88553D13
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Certum SMIME ECC Root CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum SMIME ECC Root CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum SMIME ECC Root CA
- Serial: 9AE84EF80016555FC27E5F0DB382D979
- SHA-256: 0BA1591A23AFDE691EE7E9D4881B03E69A178AB6B5BD5FC2EE31E4BEC176C98B
- SPKI SHA-256: 797F5E7074682B2F2AD7F127AC467CAD85BB5922910B6438743FBF6A7C47FB3B
- Validity: 2023-01-27 to 2048-01-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=84a61b66-db2a-4a62-a227-ea3624e52f3e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=55c7a16e-283a-4bf2-8e88-3f716fff5cea, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5071ae66-985b-4eba-81c0-ee2df7f0a57b
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            9a:e8:4e:f8:00:16:55:5f:c2:7e:5f:0d:b3:82:d9:79
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., CN = Certum SMIME ECC Root CA
        Validity
            Not Before: Jan 27 09:02:56 2023 GMT
            Not After : Jan 26 09:02:56 2048 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum SMIME ECC Root CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                1B:0F:E0:91:C0:FD:AD:38:27:9D:A1:04:A9:F9:E6:5E:CA:71:62:CE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 0BA1591A23AFDE691EE7E9D4881B03E69A178AB6B5BD5FC2EE31E4BEC176C98B
    SPKI SHA256: 797F5E7074682B2F2AD7F127AC467CAD85BB5922910B6438743FBF6A7C47FB3B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Certum SMIME RSA Root CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum SMIME RSA Root CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum SMIME RSA Root CA
- Serial: 4212C0F546E05991DAD135455C2F8BC1
- SHA-256: 08EF47A61F8D33B37B429FE3127B59F645E3BA4A82470F8380FFB21FDD3B2131
- SPKI SHA-256: 291DC5F6621F8675EF9069C4708A5F0647D608B6AC4C6EEF019114E998F1CD1E
- Validity: 2023-01-27 to 2048-01-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=84a61b66-db2a-4a62-a227-ea3624e52f3e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=55c7a16e-283a-4bf2-8e88-3f716fff5cea, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5071ae66-985b-4eba-81c0-ee2df7f0a57b
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            42:12:c0:f5:46:e0:59:91:da:d1:35:45:5c:2f:8b:c1
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., CN = Certum SMIME RSA Root CA
        Validity
            Not Before: Jan 27 08:39:38 2023 GMT
            Not After : Jan 26 08:39:38 2048 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum SMIME RSA Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                3E:DE:0E:9A:07:7C:0A:64:5A:B0:6C:7B:1D:A8:25:4A:F4:8E:AC:78
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 08EF47A61F8D33B37B429FE3127B59F645E3BA4A82470F8380FFB21FDD3B2131
    SPKI SHA256: 291DC5F6621F8675EF9069C4708A5F0647D608B6AC4C6EEF019114E998F1CD1E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Certum TLS ECC Root CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS ECC Root CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS ECC Root CA
- Serial: B07EC0CB2E05E63C71DA0D7F997971F3
- SHA-256: 630CCB83B0180A992495E039D2613C3287A8102F8A8D703DB1330A3E86D4E653
- SPKI SHA-256: DDF469B7A279BB252D97EE2D3B0ABF60F60D0FA54918AA95D30235800F9CDA1A
- Validity: 2023-01-27 to 2048-01-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.certum.pl/cp-cps-tls/certum-cp-cps-tls-certificates-en-1-0-1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=84a61b66-db2a-4a62-a227-ea3624e52f3e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=55c7a16e-283a-4bf2-8e88-3f716fff5cea, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a23fcf5d-bdb5-45d3-abbb-2b230214f989, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7799eaad-dd3c-489b-9dd1-21c5c1c6046c
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: https://crl.certum.pl/certumtlseccrootca.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b0:7e:c0:cb:2e:05:e6:3c:71:da:0d:7f:99:79:71:f3
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., CN = Certum TLS ECC Root CA
        Validity
            Not Before: Jan 27 08:57:13 2023 GMT
            Not After : Jan 26 08:57:13 2048 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum TLS ECC Root CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                30:BD:17:08:17:FE:B5:10:86:94:0D:78:63:72:6C:58:67:B9:D0:EA
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 630CCB83B0180A992495E039D2613C3287A8102F8A8D703DB1330A3E86D4E653
    SPKI SHA256: DDF469B7A279BB252D97EE2D3B0ABF60F60D0FA54918AA95D30235800F9CDA1A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Certum TLS RSA Root CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS RSA Root CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS RSA Root CA
- Serial: E7DD2138A2C94146FF5F121789950553
- SHA-256: ED12A6E9289239D66CA1D244CE90C623AC305AD05602DA352BCFC5FEF2C4458D
- SPKI SHA-256: 8C8474414760A2F5986F6AC802A66F37EB6B360DD8EE7747A8B6C92F08B34D9E
- Validity: 2023-01-27 to 2048-01-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.certum.pl/cp-cps-tls/certum-cp-cps-tls-certificates-en-1-0-1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=84a61b66-db2a-4a62-a227-ea3624e52f3e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=55c7a16e-283a-4bf2-8e88-3f716fff5cea, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a23fcf5d-bdb5-45d3-abbb-2b230214f989, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7799eaad-dd3c-489b-9dd1-21c5c1c6046c
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: https://crl.certum.pl/certumtlsrsarootca.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            e7:dd:21:38:a2:c9:41:46:ff:5f:12:17:89:95:05:53
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., CN = Certum TLS RSA Root CA
        Validity
            Not Before: Jan 27 08:33:02 2023 GMT
            Not After : Jan 26 08:33:02 2048 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum TLS RSA Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                EB:34:E4:00:A1:E6:7B:7C:D2:23:F4:CA:D7:4E:C0:CB:85:67:15:76
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: ED12A6E9289239D66CA1D244CE90C623AC305AD05602DA352BCFC5FEF2C4458D
    SPKI SHA256: 8C8474414760A2F5986F6AC802A66F37EB6B360DD8EE7747A8B6C92F08B34D9E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Certum Trusted Network CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 0444C0
- SHA-256: 5C58468D55F58E497E743982D2B50010B6D165374ACF83A7D4A32DB768C4408E
- SPKI SHA-256: AA2630A7B617B04D0A294BAB7A8CAAA5016E6DBE604837A83A85719FAB667EB5
- Validity: 2008-10-22 to 2029-12-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.certum.eu/en/wp-content/uploads/2025/11/Certification-Policy-of-Certum-Certification-Services_v5.2.pdf, https://www.certum.eu/en/wp-content/uploads/2026/05/Certification-Practice-Statement-of-Certum-Certification-Services_v8.4.pdf, https://repository.certum.pl/cp-cps-tls/certum-cp-cps-tls-certificates-en-1-0-1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=84a61b66-db2a-4a62-a227-ea3624e52f3e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=55c7a16e-283a-4bf2-8e88-3f716fff5cea, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a23fcf5d-bdb5-45d3-abbb-2b230214f989, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7799eaad-dd3c-489b-9dd1-21c5c1c6046c, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5071ae66-985b-4eba-81c0-ee2df7f0a57b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c175793c-60ed-4c70-8bf7-f875050e202a
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://certum-crl.wt.trustasia.com/ctnca.crl, http://certum.crl.sheca.com/ctnca.crl, http://crl.certum.pl/ctnca.crl, http://sslcom.crl.certum.pl/ctnca.crl, http://subca.crl.certum.pl/ctnca.crl, http://trustasia.crl.certum.pl/ctnca.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 279744 (0x444c0)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Oct 22 12:07:37 2008 GMT
            Not After : Dec 31 12:07:37 2029 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5C58468D55F58E497E743982D2B50010B6D165374ACF83A7D4A32DB768C4408E
    SPKI SHA256: AA2630A7B617B04D0A294BAB7A8CAAA5016E6DBE604837A83A85719FAB667EB5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Certum Trusted Network CA 2

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA 2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA 2
- Serial: 21D6D04A4F250FC93237FCAA5E128DE9
- SHA-256: B676F2EDDAE8775CD36CB0F63CD1D4603961F49E6265BA013A2F0307B6D0B804
- SPKI SHA-256: 6B3B57E9EC88D1BB3D01637FF33C7698B3C9758255E9F01EA9178F3E7F3B2B52
- Validity: 2011-10-06 to 2046-10-06
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.certum.eu/en/wp-content/uploads/2025/11/Certification-Policy-of-Certum-Certification-Services_v5.2.pdf, https://www.certum.eu/en/wp-content/uploads/2026/05/Certification-Practice-Statement-of-Certum-Certification-Services_v8.4.pdf, https://repository.certum.pl/cp-cps-tls/certum-cp-cps-tls-certificates-en-1-0-1.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=84a61b66-db2a-4a62-a227-ea3624e52f3e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=55c7a16e-283a-4bf2-8e88-3f716fff5cea, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a23fcf5d-bdb5-45d3-abbb-2b230214f989, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7799eaad-dd3c-489b-9dd1-21c5c1c6046c, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5071ae66-985b-4eba-81c0-ee2df7f0a57b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c175793c-60ed-4c70-8bf7-f875050e202a
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/ctnca2.crl, http://subca.crl.certum.pl/ctnca2.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            21:d6:d0:4a:4f:25:0f:c9:32:37:fc:aa:5e:12:8d:e9
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA 2
        Validity
            Not Before: Oct  6 08:39:56 2011 GMT
            Not After : Oct  6 08:39:56 2046 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                B6:A1:54:39:02:C3:A0:3F:8E:8A:BC:FA:D4:F8:1C:A6:D1:3A:0E:FD
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: B676F2EDDAE8775CD36CB0F63CD1D4603961F49E6265BA013A2F0307B6D0B804
    SPKI SHA256: 6B3B57E9EC88D1BB3D01637FF33C7698B3C9758255E9F01EA9178F3E7F3B2B52
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_wrong_time_format_pre2050: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Certum Trusted Root CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 1EBF5950B8C980374C06F7EB554FB5ED
- SHA-256: FE7696573855773E37A95E7AD4D9CC96C30157C15D31765BA9B15704E1AE78FD
- SPKI SHA-256: 681DC482C296C8402C6EBB20E68309A3BC846523AE34B984A84EE697A3312DB7
- Validity: 2018-03-16 to 2043-03-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.certum.eu/en/wp-content/uploads/2025/11/Certification-Policy-of-Certum-Certification-Services_v5.2.pdf, https://www.certum.eu/en/wp-content/uploads/2026/05/Certification-Practice-Statement-of-Certum-Certification-Services_v8.4.pdf, https://repository.certum.pl/cp-cps-tls/certum-cp-cps-tls-certificates-en-1-0-1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=84a61b66-db2a-4a62-a227-ea3624e52f3e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=55c7a16e-283a-4bf2-8e88-3f716fff5cea, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a23fcf5d-bdb5-45d3-abbb-2b230214f989, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7799eaad-dd3c-489b-9dd1-21c5c1c6046c, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5071ae66-985b-4eba-81c0-ee2df7f0a57b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c175793c-60ed-4c70-8bf7-f875050e202a
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/ctrca.crl, http://subca.crl.certum.pl/ctrca.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1e:bf:59:50:b8:c9:80:37:4c:06:f7:eb:55:4f:b5:ed
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Mar 16 12:10:13 2018 GMT
            Not After : Mar 16 12:10:13 2043 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: FE7696573855773E37A95E7AD4D9CC96C30157C15D31765BA9B15704E1AE78FD
    SPKI SHA256: 681DC482C296C8402C6EBB20E68309A3BC846523AE34B984A84EE697A3312DB7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### 4fastssl.com

- Subject: countryName=PL, organizationName=3S2N Sp. z o.o., organizationalUnitName=3S2N Sp. z o.o., commonName=4fastssl.com
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 7C0876AE51F52F127A953247B4834B62
- SHA-256: 31AC346B31073DC0D134E29FC212CC4A15ED3530EEA1EDCFC8DACB36492D5DE4
- SPKI SHA-256: B0DED8BF4A93CA35BE0494DF933755BD8C5DD44C5417097772FC1B2F3B64E457
- Validity: 2017-04-18 to 2027-04-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/3s2nsha2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:08:76:ae:51:f5:2f:12:7a:95:32:47:b4:83:4b:62
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Apr 18 10:09:36 2017 GMT
            Not After : Apr 16 10:09:36 2027 GMT
        Subject: C = PL, O = 3S2N Sp. z o.o., OU = 3S2N Sp. z o.o., CN = 4fastssl.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Subject Key Identifier:
                0E:AD:55:CA:B0:DB:4E:5F:2B:FF:3E:70:6F:F1:6C:D7:D2:73:E5:44
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 31AC346B31073DC0D134E29FC212CC4A15ED3530EEA1EDCFC8DACB36492D5DE4
    SPKI SHA256: B0DED8BF4A93CA35BE0494DF933755BD8C5DD44C5417097772FC1B2F3B64E457
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Abitab SSL Domain Validated

- Subject: countryName=UY, organizationName=Abitab S.A., organizationalUnitName=IDdigital, commonName=Abitab SSL Domain Validated
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 101D422255E1FE41866660C480177611
- SHA-256: E67D18639367C5B29BF7A5683B56B0F0C23155C8FE9452BCFE51681436023742
- SPKI SHA-256: F708359316E5FDEC3EE7EEEDA5AB6D3CFBBF8FD6E00DCB64B9C364A4E1BE53AB
- Validity: 2018-08-22 to 2027-05-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://abitabdv.crl.certum.pl/abitabdv.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            10:1d:42:22:55:e1:fe:41:86:66:60:c4:80:17:76:11
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Aug 22 07:09:52 2018 GMT
            Not After : May  2 07:09:52 2027 GMT
        Subject: C = UY, O = Abitab S.A., OU = IDdigital, CN = Abitab SSL Domain Validated
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                6F:40:42:1B:2F:E9:06:6B:68:22:4B:0B:52:81:34:4A:1D:8E:B3:76
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E67D18639367C5B29BF7A5683B56B0F0C23155C8FE9452BCFE51681436023742
    SPKI SHA256: F708359316E5FDEC3EE7EEEDA5AB6D3CFBBF8FD6E00DCB64B9C364A4E1BE53AB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Abitab SSL Extended Validation

- Subject: countryName=UY, organizationName=Abitab S.A., organizationalUnitName=IDdigital, commonName=Abitab SSL Extended Validation
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 63E9B37A0FEA72231484B67EED4BA9E3
- SHA-256: 93B281BD81D83CF986659DFFD0AF57993B92E6E4614162539F750524CE11BBCB
- SPKI SHA-256: CB629A02C53555F25F5914183DEAB71D5C4ED4656BC12C38C46ABBAD226DC882
- Validity: 2018-08-22 to 2027-05-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://abitabev.crl.certum.pl/abitabev.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            63:e9:b3:7a:0f:ea:72:23:14:84:b6:7e:ed:4b:a9:e3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Aug 22 07:12:25 2018 GMT
            Not After : May  2 07:12:25 2027 GMT
        Subject: C = UY, O = Abitab S.A., OU = IDdigital, CN = Abitab SSL Extended Validation
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                84:1C:13:77:0D:36:E8:F7:6C:3A:2F:96:0C:AC:C6:77:3D:46:AA:F5
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 93B281BD81D83CF986659DFFD0AF57993B92E6E4614162539F750524CE11BBCB
    SPKI SHA256: CB629A02C53555F25F5914183DEAB71D5C4ED4656BC12C38C46ABBAD226DC882
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Abitab SSL Organization Validated

- Subject: countryName=UY, organizationName=Abitab S.A., organizationalUnitName=IDdigital, commonName=Abitab SSL Organization Validated
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: F0D59415C6DECB4F888F2837E606810F
- SHA-256: EEF9066424C23508E9C65F84671B14E16DA1BEC358E75FC6382ECA070AE861BE
- SPKI SHA-256: 13818B0ED4C4C0EED409E02D3BC89B6CEBBA14B671488502FDF07321B339995E
- Validity: 2018-08-22 to 2027-05-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://abitabov.crl.certum.pl/abitabov.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            f0:d5:94:15:c6:de:cb:4f:88:8f:28:37:e6:06:81:0f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Aug 22 07:10:59 2018 GMT
            Not After : May  2 07:10:59 2027 GMT
        Subject: C = UY, O = Abitab S.A., OU = IDdigital, CN = Abitab SSL Organization Validated
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                86:0B:75:38:9D:CB:83:B8:71:06:0D:1F:5D:E8:8E:D4:E8:9E:90:66
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EEF9066424C23508E9C65F84671B14E16DA1BEC358E75FC6382ECA070AE861BE
    SPKI SHA256: 13818B0ED4C4C0EED409E02D3BC89B6CEBBA14B671488502FDF07321B339995E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### ANTIC DV CA

- Subject: countryName=CM, organizationName=National Agency for Information and Communication Technologies, commonName=ANTIC DV CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: D32C4556DD4ACFE0284D1368DC83757F
- SHA-256: E53A69193E22FAECC833F80631BE15E020A04C20BB679FD351F0CB95C0089E50
- SPKI SHA-256: 8DB0D59359101BA6CB43BA25D0ED3C3E791E1B2ECF8DACF5133DAA4BFA3FFF2D
- Validity: 2022-07-28 to 2027-05-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://anticdv.crl.certum.pl/anticdv.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d3:2c:45:56:dd:4a:cf:e0:28:4d:13:68:dc:83:75:7f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jul 28 08:16:58 2022 GMT
            Not After : May 31 08:16:58 2027 GMT
        Subject: C = CM, O = National Agency for Information and Communication Technologies, CN = ANTIC DV CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4D:4D:1A:5D:45:92:91:28:55:70:AD:DA:96:57:E6:1F:D6:48:D8:5A
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E53A69193E22FAECC833F80631BE15E020A04C20BB679FD351F0CB95C0089E50
    SPKI SHA256: 8DB0D59359101BA6CB43BA25D0ED3C3E791E1B2ECF8DACF5133DAA4BFA3FFF2D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### AnTrust OV SSL G2 R30 CA

- Subject: countryName=CN, organizationName=Anhui Spider Information Technology Co., Ltd., commonName=AnTrust OV SSL G2 R30 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 12F490383E570B33AA8465128C1B1E0F
- SHA-256: B0E7145A48B9FAE4A499071FE9C4FA59032DF72E75955B2B3EFB79599E4A53E0
- SPKI SHA-256: 568D241D7800FBFFE51636B18A769ACE68E9E929F3C36740350CEFE984D4E67D
- Validity: 2025-06-17 to 2030-06-06
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://antrustovsslg2r30ca.crl.certum.pl/antrustovsslg2r30ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            12:f4:90:38:3e:57:0b:33:aa:84:65:12:8c:1b:1e:0f
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Jun 17 09:09:20 2025 GMT
            Not After : Jun  6 09:09:20 2030 GMT
        Subject: C = CN, O = "Anhui Spider Information Technology Co., Ltd.", CN = AnTrust OV SSL G2 R30 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E3:53:56:68:79:87:F5:37:42:99:44:F9:E1:0E:E6:80:2A:27:5D:56
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: B0E7145A48B9FAE4A499071FE9C4FA59032DF72E75955B2B3EFB79599E4A53E0
    SPKI SHA256: 568D241D7800FBFFE51636B18A769ACE68E9E929F3C36740350CEFE984D4E67D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### AutonTrust PRO DV TLS G2 R31 CA

- Subject: countryName=SG, organizationName=AutonTrust PTE. LTD., commonName=AutonTrust PRO DV TLS G2 R31 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 2EAEA98C3262C3D3AA2CE0224BD65394
- SHA-256: 31480F53BFF4B2A75DCE38E7961AFBBDB7E3760D32A727601785564869BEE7A7
- SPKI SHA-256: E08B738DDC010B6273CAA2432627848E330B3E789EC939CB571BF2C99028594B
- Validity: 2026-06-17 to 2031-06-06
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://autontrustprodvtlsg2r31ca.crl.certum.pl/autontrustprodvtlsg2r31ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2e:ae:a9:8c:32:62:c3:d3:aa:2c:e0:22:4b:d6:53:94
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Jun 17 07:31:28 2026 GMT
            Not After : Jun  6 07:31:28 2031 GMT
        Subject: C = SG, O = AutonTrust PTE. LTD., CN = AutonTrust PRO DV TLS G2 R31 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                23:04:48:3B:AE:66:00:A1:04:D1:16:FD:61:A5:0B:FE:04:E1:79:0F
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 31480F53BFF4B2A75DCE38E7961AFBBDB7E3760D32A727601785564869BEE7A7
    SPKI SHA256: E08B738DDC010B6273CAA2432627848E330B3E789EC939CB571BF2C99028594B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certification Authority of WoSign G2

- Subject: countryName=CN, organizationName=WoSign CA Limited, commonName=Certification Authority of WoSign G2
- Issuer: countryName=PL, organizationName=Unizeto Sp. z o.o., commonName=Certum CA
- Serial: 7BBC12A55C668004B9FE2A0B8B688120
- SHA-256: 1092C43D57BCDA0AF70291E37FDDE88B02DE83E3F4013272D4CA2AE3C7498FE4
- SPKI SHA-256: 381A3FC7A8B082FA28613A4D07F2C7553F4E1918EE07CAA9E8B7CEDE5A9CA06A
- Validity: 2012-01-01 to 2020-11-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 2
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://wosign.repository.certum.eu/certumca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:bc:12:a5:5c:66:80:04:b9:fe:2a:0b:8b:68:81:20
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Sp. z o.o., CN = Certum CA
        Validity
            Not Before: Jan  1 01:59:59 2012 GMT
            Not After : Nov  2 01:59:59 2020 GMT
        Subject: C = CN, O = WoSign CA Limited, CN = Certification Authority of WoSign G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:2
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                FA:60:A9:EB:65:C5:DD:16:14:08:4E:0C:0F:8D:9B:E0:F7:64:AF:67
            X509v3 Authority Key Identifier:
                DirName:/C=PL/O=Unizeto Sp. z o.o./CN=Certum CA
                serial:01:00:20
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://wosign.repository.certum.eu/certumca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://wosign.repository.certum.eu/certumca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1092C43D57BCDA0AF70291E37FDDE88B02DE83E3F4013272D4CA2AE3C7498FE4
    SPKI SHA256: 381A3FC7A8B082FA28613A4D07F2C7553F4E1918EE07CAA9E8B7CEDE5A9CA06A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":2}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://wosign.repository.certum.eu/certumca.cer
- CRL Distribution Points: http://wosign.repository.certum.eu/certumca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_authority_key_identifier_no_key_identifier: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Certification Authority of WoSign G2

- Subject: countryName=CN, organizationName=WoSign CA Limited, commonName=Certification Authority of WoSign G2
- Issuer: countryName=PL, organizationName=Unizeto Sp. z o.o., commonName=Certum CA
- Serial: BC726666FF58BFF002E5223CAE682BF8
- SHA-256: 7BDA50131EA7E55C8FDDA63563D12314A7159D5621333BA8BCDAD0B8A3A50E6C
- SPKI SHA-256: 381A3FC7A8B082FA28613A4D07F2C7553F4E1918EE07CAA9E8B7CEDE5A9CA06A
- Validity: 2012-02-01 to 2020-11-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 2
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://wosign.crl.certum.eu/certumca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            bc:72:66:66:ff:58:bf:f0:02:e5:22:3c:ae:68:2b:f8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Sp. z o.o., CN = Certum CA
        Validity
            Not Before: Feb  1 01:59:00 2012 GMT
            Not After : Nov  2 01:01:59 2020 GMT
        Subject: C = CN, O = WoSign CA Limited, CN = Certification Authority of WoSign G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:2
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                FA:60:A9:EB:65:C5:DD:16:14:08:4E:0C:0F:8D:9B:E0:F7:64:AF:67
            X509v3 Authority Key Identifier:
                DirName:/C=PL/O=Unizeto Sp. z o.o./CN=Certum CA
                serial:01:00:20
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://wosign.crl.certum.eu/certumca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7BDA50131EA7E55C8FDDA63563D12314A7159D5621333BA8BCDAD0B8A3A50E6C
    SPKI SHA256: 381A3FC7A8B082FA28613A4D07F2C7553F4E1918EE07CAA9E8B7CEDE5A9CA06A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":2}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: -
- CRL Distribution Points: http://wosign.crl.certum.eu/certumca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_authority_key_identifier_no_key_identifier: 
- [historical] error e_utc_time_does_not_include_seconds: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### Certum Class I CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Class I CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 049271
- SHA-256: 9D2B4698D46AB43733A561019B5F8EE8EDA6FF57E8204BC9551B52AAACD70FFB
- SPKI SHA-256: 31B17FEB3CC434980D301B5D895E91FFDF8667B97A365E108F017E196DFD626B
- Validity: 2009-04-25 to 2024-04-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 299633 (0x49271)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Apr 25 21:15:12 2009 GMT
            Not After : Apr 25 21:15:12 2024 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Class I CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                62:E9:C1:BB:CB:6F:82:91:53:B8:81:E7:22:99:14:CB:12:24:2C:30
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9D2B4698D46AB43733A561019B5F8EE8EDA6FF57E8204BC9551B52AAACD70FFB
    SPKI SHA256: 31B17FEB3CC434980D301B5D895E91FFDF8667B97A365E108F017E196DFD626B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Certum Class I CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Class I CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA 2
- Serial: B47DE80B8745855C6E9C4E6BB189ABB4
- SHA-256: 337AC56F39FB8877B9F0524554B755D1835A807FFC9058DFC6DE1B707F696123
- SPKI SHA-256: 5ABEECD5E79ED66D094BFEAD76BE58BBFAC93A9AAC8EC6FC21E35C8664A390BE
- Validity: 2013-01-24 to 2028-01-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/c12.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b4:7d:e8:0b:87:45:85:5c:6e:9c:4e:6b:b1:89:ab:b4
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA 2
        Validity
            Not Before: Jan 24 11:38:56 2013 GMT
            Not After : Jan 24 11:38:56 2028 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Class I CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                E0:F3:86:B9:07:08:7E:A5:1C:01:33:6E:F5:74:BF:2A:5F:66:D8:23
            X509v3 Authority Key Identifier:
                B6:A1:54:39:02:C3:A0:3F:8E:8A:BC:FA:D4:F8:1C:A6:D1:3A:0E:FD
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 337AC56F39FB8877B9F0524554B755D1835A807FFC9058DFC6DE1B707F696123
    SPKI SHA256: 5ABEECD5E79ED66D094BFEAD76BE58BBFAC93A9AAC8EC6FC21E35C8664A390BE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca2.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_wrong_time_format_pre2050: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum Class I CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Class I CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 177D3B09461EFBE8F0FAA4D35E2DA799
- SHA-256: B34A33B44474FDB0078F113527BBDB76FE5BF81CA24BB86D628136C5016043E8
- SPKI SHA-256: 31B17FEB3CC434980D301B5D895E91FFDF8667B97A365E108F017E196DFD626B
- Validity: 2009-04-25 to 2024-04-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/c1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            17:7d:3b:09:46:1e:fb:e8:f0:fa:a4:d3:5e:2d:a7:99
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Apr 25 21:15:12 2009 GMT
            Not After : Apr 25 21:15:12 2024 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Class I CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                62:E9:C1:BB:CB:6F:82:91:53:B8:81:E7:22:99:14:CB:12:24:2C:30
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B34A33B44474FDB0078F113527BBDB76FE5BF81CA24BB86D628136C5016043E8
    SPKI SHA256: 31B17FEB3CC434980D301B5D895E91FFDF8667B97A365E108F017E196DFD626B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_wrong_time_format_pre2050: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Certum Class I CA SHA2

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Class I CA SHA2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: D147AA29B04289F7F5C64247009FD339
- SHA-256: 2AB4DFF69D75BBF9541060B434CE5AD0C4DACB7AF0DBF21D3616AFCB473796DE
- SPKI SHA-256: 0E530BDC821962629B91CE6C83F565C2EEC698B3A14C7C65C220E7B8CF2E5DCA
- Validity: 2014-09-11 to 2027-06-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/class1casha2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d1:47:aa:29:b0:42:89:f7:f5:c6:42:47:00:9f:d3:39
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Sep 11 12:00:00 2014 GMT
            Not After : Jun  9 10:46:39 2027 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Class I CA SHA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                4D:CB:B4:D9:BB:B2:E3:41:98:1E:70:9B:67:9F:2C:5D:F6:39:9C:61
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2AB4DFF69D75BBF9541060B434CE5AD0C4DACB7AF0DBF21D3616AFCB473796DE
    SPKI SHA256: 0E530BDC821962629B91CE6C83F565C2EEC698B3A14C7C65C220E7B8CF2E5DCA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Certum Client Authentication G2 E40 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Client Authentication G2 E40 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum EC-384 CA
- Serial: 16FCABEB8BF3B1F955677DAA3B331A38
- SHA-256: 2B94BD83867AD92CDC7432D5B9D8AA5635A2974542510C36ACFAF9D91A2B7EBE
- SPKI SHA-256: 8A0FB36179D53AAAAB638BA77237D0D263FA7CC58994A5DCCED4E37D0A0662E0
- Validity: 2025-06-17 to 2040-06-03
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://certumclientauthenticationg2e40ca.crl.certum.pl/certumclientauthenticationg2e40ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            16:fc:ab:eb:8b:f3:b1:f9:55:67:7d:aa:3b:33:1a:38
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum EC-384 CA
        Validity
            Not Before: Jun 17 09:13:25 2025 GMT
            Not After : Jun  3 09:13:25 2040 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum Client Authentication G2 E40 CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/cec384ca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8D:06:66:74:24:76:3A:F3:89:F7:BC:D6:BD:47:7D:2F:BC:10:5F:4B
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/cec384ca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                FA:03:47:4D:FB:F2:69:34:5E:1B:CC:9C:6C:F5:CC:E4:97:90:C8:97
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 2B94BD83867AD92CDC7432D5B9D8AA5635A2974542510C36ACFAF9D91A2B7EBE
    SPKI SHA256: 8A0FB36179D53AAAAB638BA77237D0D263FA7CC58994A5DCCED4E37D0A0662E0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/cec384ca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum Code Signing 2021 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Code Signing 2021 CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA 2
- Serial: 99A3800A26553B65ABDC6E84A6B3EA39
- SHA-256: 5AC82CBE9F28351E85D5262293BCFC8BACABEAD1294F248C1DF17F81CE5AC3CE
- SPKI SHA-256: E64D532CF987EE0260FDA04A8251103CB650F7CF8FC92A7D3865F5D6E8992E50
- Validity: 2021-05-19 to 2036-05-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/ccsca2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA 2
        Validity
            Not Before: May 19 05:32:18 2021 GMT
            Not After : May 18 05:32:18 2036 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum Code Signing 2021 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                DD:74:5D:4C:00:DB:7B:9F:A0:74:CA:B1:6E:F7:3C:C0:32:C0:70:CD
            X509v3 Authority Key Identifier:
                B6:A1:54:39:02:C3:A0:3F:8E:8A:BC:FA:D4:F8:1C:A6:D1:3A:0E:FD
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 5AC82CBE9F28351E85D5262293BCFC8BACABEAD1294F248C1DF17F81CE5AC3CE
    SPKI SHA256: E64D532CF987EE0260FDA04A8251103CB650F7CF8FC92A7D3865F5D6E8992E50
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca2.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum Code Signing CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Code Signing CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA 2
- Serial: 7F46F004F1A530486AA6B8B95E946748
- SHA-256: 1B82F666CEDC5D302B0A8F1CCE498CEECD730208A2337DC7664FEAC3DD2D0F92
- SPKI SHA-256: 8C8F2ACF398E86DCDE80B4D0CB3D5B90B20DDDC4C85D78B411279A41BB7A7C31
- Validity: 2013-01-24 to 2028-01-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/csca2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:46:f0:04:f1:a5:30:48:6a:a6:b8:b9:5e:94:67:48
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA 2
        Validity
            Not Before: Jan 24 11:50:03 2013 GMT
            Not After : Jan 24 11:50:03 2028 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Code Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                8B:E9:26:C4:B8:7F:3A:0E:0A:2F:EE:EC:05:4E:17:14:93:E8:75:20
            X509v3 Authority Key Identifier:
                B6:A1:54:39:02:C3:A0:3F:8E:8A:BC:FA:D4:F8:1C:A6:D1:3A:0E:FD
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 1B82F666CEDC5D302B0A8F1CCE498CEECD730208A2337DC7664FEAC3DD2D0F92
    SPKI SHA256: 8C8F2ACF398E86DCDE80B4D0CB3D5B90B20DDDC4C85D78B411279A41BB7A7C31
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca2.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_wrong_time_format_pre2050: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum Code Signing CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Code Signing CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: FA33B79DD496CFD10C846539A49D63B5
- SHA-256: 0E8CC50D64DF43D35971DEC320B4BA226B0DC844380EB4B2BB7F845B12A3B48A
- SPKI SHA-256: 1BEF3990DA51B41010A69C3F47B326F52877FA10B9F05856319AE127AFBF2410
- Validity: 2011-09-20 to 2026-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/csca.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            fa:33:b7:9d:d4:96:cf:d1:0c:84:65:39:a4:9d:63:b5
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Sep 20 11:04:33 2011 GMT
            Not After : Sep 20 23:59:59 2026 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Code Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                78:2F:90:F1:4A:5C:CC:34:51:1D:80:23:F2:12:1B:7D:1A:23:C1:8F
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 0E8CC50D64DF43D35971DEC320B4BA226B0DC844380EB4B2BB7F845B12A3B48A
    SPKI SHA256: 1BEF3990DA51B41010A69C3F47B326F52877FA10B9F05856319AE127AFBF2410
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_wrong_time_format_pre2050: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Certum Code Signing CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Code Signing CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 436B88D83FD40FD7F24E1DD22285F27E
- SHA-256: 6E196A0740F7E68B9FBBE2222960F04B492FBB4931C8DE1B04F1BCD165CBDE79
- SPKI SHA-256: 1BEF3990DA51B41010A69C3F47B326F52877FA10B9F05856319AE127AFBF2410
- Validity: 2011-09-20 to 2026-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://crl.certum.pl/csca.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            43:6b:88:d8:3f:d4:0f:d7:f2:4e:1d:d2:22:85:f2:7e
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Sep 20 11:04:33 2011 GMT
            Not After : Sep 20 23:59:59 2026 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Code Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                78:2F:90:F1:4A:5C:CC:34:51:1D:80:23:F2:12:1B:7D:1A:23:C1:8F
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            Authority Information Access:
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6E196A0740F7E68B9FBBE2222960F04B492FBB4931C8DE1B04F1BCD165CBDE79
    SPKI SHA256: 1BEF3990DA51B41010A69C3F47B326F52877FA10B9F05856319AE127AFBF2410
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- expires_within_398_days

### Certum Code Signing CA SHA2

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Code Signing CA SHA2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 6B326A0F0328D37A1D530BFD23BD48E2
- SHA-256: 06E5BAF59E3DA805CE9F286DF1BAEA93D2BD671F6D73728A25EB6AC697F204C1
- SPKI SHA-256: 9FC9321AE26600F77F3B1D9EA54D6F36B54E4E9E65C2BE32E57061E34D4A904B
- Validity: 2015-10-29 to 2027-06-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/cscasha2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Oct 29 11:30:29 2015 GMT
            Not After : Jun  9 11:30:29 2027 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Code Signing CA SHA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                C0:7B:B4:C8:B7:6E:56:A7:09:48:9A:F8:72:4F:D7:D7:24:2C:36:3E
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 06E5BAF59E3DA805CE9F286DF1BAEA93D2BD671F6D73728A25EB6AC697F204C1
    SPKI SHA256: 9FC9321AE26600F77F3B1D9EA54D6F36B54E4E9E65C2BE32E57061E34D4A904B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Certum Digital Identification CA SHA2

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Digital Identification CA SHA2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 66DAEF03DB8461916B25BA83FB174E13
- SHA-256: 0F672D92A0B06CEE948F03B272502602C6E37D2A2AD694A31D5DE313196E9282
- SPKI SHA-256: 41D72A22FD8E3CDB03EF9C37D9DF6D303C9A8B6F82973491B7FE3D8B4598C1B5
- Validity: 2015-04-21 to 2027-06-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/dicasha2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            66:da:ef:03:db:84:61:91:6b:25:ba:83:fb:17:4e:13
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Apr 21 12:45:26 2015 GMT
            Not After : Jun  9 12:45:26 2027 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Digital Identification CA SHA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                3F:CA:58:EA:F1:C9:09:7E:6E:33:C1:23:AD:4E:AD:3E:3D:6C:45:A7
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0F672D92A0B06CEE948F03B272502602C6E37D2A2AD694A31D5DE313196E9282
    SPKI SHA256: 41D72A22FD8E3CDB03EF9C37D9DF6D303C9A8B6F82973491B7FE3D8B4598C1B5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Certum Document Signing G2 R40 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Document Signing G2 R40 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: E822B4CC6F35F3DAAEFF13441E38BB0F
- SHA-256: B8ECE24174FDA6E7A29FAD6FEE123D03BB32C5ABC6424DD036EAEC7FA1021427
- SPKI SHA-256: 164A23F06AF17D8A9D02043DEA662AA4CC1198B10E69A28A4A617564F2C378F9
- Validity: 2025-06-17 to 2040-06-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://certumdocumentsigningg2r40ca.crl.certum.pl/certumdocumentsigningg2r40ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12, 1.3.6.1.5.5.7.3.36
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            e8:22:b4:cc:6f:35:f3:da:ae:ff:13:44:1e:38:bb:0f
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Jun 17 09:11:10 2025 GMT
            Not After : Jun  3 09:11:10 2040 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum Document Signing G2 R40 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12, 1.3.6.1.5.5.7.3.36
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                C0:CE:80:A7:C6:EB:91:A7:B9:EE:B6:FB:82:56:64:2D:D4:F2:38:25
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: B8ECE24174FDA6E7A29FAD6FEE123D03BB32C5ABC6424DD036EAEC7FA1021427
    SPKI SHA256: 164A23F06AF17D8A9D02043DEA662AA4CC1198B10E69A28A4A617564F2C378F9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12, 1.3.6.1.5.5.7.3.36
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum Domain Validation CA SHA2

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Domain Validation CA SHA2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 26DDD22B46C9C44D5A694D39807E72AD
- SHA-256: 129FB5DE501E24041CD14A81075FD1CDE257408D4A353E636912E38BDDA2D3FB
- SPKI SHA-256: 4B801B24D1AFC92E7B9F3270BFCB0F31430BF151D2A87D6F6E205FB5D3DC12B2
- Validity: 2014-09-11 to 2027-06-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/dvcasha2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            26:dd:d2:2b:46:c9:c4:4d:5a:69:4d:39:80:7e:72:ad
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Sep 11 12:00:00 2014 GMT
            Not After : Jun  9 10:46:39 2027 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Domain Validation CA SHA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                E5:31:AD:BF:3A:11:96:F4:83:BC:50:3C:D4:B7:90:9B:90:EE:DE:25
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 129FB5DE501E24041CD14A81075FD1CDE257408D4A353E636912E38BDDA2D3FB
    SPKI SHA256: 4B801B24D1AFC92E7B9F3270BFCB0F31430BF151D2A87D6F6E205FB5D3DC12B2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Certum DV TLS G2 E39 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum DV TLS G2 E39 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum EC-384 CA
- Serial: 0A7378F3CE61A13C60A235EE5B8ED3DD
- SHA-256: 5202D5F0505C69B2F7B6DA2D15D2DD61515C63958A90C05A23D9A8CEAFDEDBFA
- SPKI SHA-256: E7BA59B8EB930401F864D9173BB257D75DFD7992916258F022D33741D2E7837D
- Validity: 2024-06-18 to 2039-06-05
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://certumdvtlsg2e39ca.crl.certum.pl/certumdvtlsg2e39ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0a:73:78:f3:ce:61:a1:3c:60:a2:35:ee:5b:8e:d3:dd
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum EC-384 CA
        Validity
            Not Before: Jun 18 07:49:15 2024 GMT
            Not After : Jun  5 07:49:15 2039 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum DV TLS G2 E39 CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/cec384ca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8D:06:66:74:24:76:3A:F3:89:F7:BC:D6:BD:47:7D:2F:BC:10:5F:4B
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/cec384ca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                8F:42:80:2D:CB:1C:CA:57:1C:3A:61:2B:2E:CD:D6:9D:23:6E:37:70
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5202D5F0505C69B2F7B6DA2D15D2DD61515C63958A90C05A23D9A8CEAFDEDBFA
    SPKI SHA256: E7BA59B8EB930401F864D9173BB257D75DFD7992916258F022D33741D2E7837D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/cec384ca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum DV TLS G2 R39 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum DV TLS G2 R39 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: A82DD9E5DCAFDF13205E70043E6B95A8
- SHA-256: 83C0A5A76844C840DFAF820FFD02ADF6573A26823EF6AF758A3384A0AC044083
- SPKI SHA-256: F76A0ADBDFEABF937CC68713FC7F64C7156A8A1837383DAB968A095BD7FB2F76
- Validity: 2024-06-18 to 2039-06-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://certumdvtlsg2r39ca.crl.certum.pl/certumdvtlsg2r39ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            a8:2d:d9:e5:dc:af:df:13:20:5e:70:04:3e:6b:95:a8
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Jun 18 07:41:22 2024 GMT
            Not After : Jun  5 07:41:22 2039 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum DV TLS G2 R39 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                33:A8:77:B7:01:38:6F:5F:1F:24:24:A2:1E:6C:14:E3:6E:22:03:DF
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 83C0A5A76844C840DFAF820FFD02ADF6573A26823EF6AF758A3384A0AC044083
    SPKI SHA256: F76A0ADBDFEABF937CC68713FC7F64C7156A8A1837383DAB968A095BD7FB2F76
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum DV TLS G3 E39 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum DV TLS G3 E39 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS ECC Root CA
- Serial: 0CFA8F09C098A90C49F632A78DD38C50
- SHA-256: DF823B3B53109E142D1C8BA5574D5DEC7F1A14AC23168D97CDC6C83081AD2BAB
- SPKI SHA-256: 41CBBDC9ABBFC1BF6A33D2CC331A912487A55DD582B86973C57576FC35619441
- Validity: 2024-04-02 to 2039-03-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://crl.certum.pl/certumdvtlsg3e39ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/certumtlseccrootca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0c:fa:8f:09:c0:98:a9:0c:49:f6:32:a7:8d:d3:8c:50
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., CN = Certum TLS ECC Root CA
        Validity
            Not Before: Apr  2 13:03:16 2024 GMT
            Not After : Mar 20 13:03:16 2039 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum DV TLS G3 E39 CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/certumtlseccrootca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                30:BD:17:08:17:FE:B5:10:86:94:0D:78:63:72:6C:58:67:B9:D0:EA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/certumtlseccrootca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E4:CF:03:40:1D:39:91:86:88:7A:F3:E5:3D:4A:0A:6D:5C:4E:3D:9A
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: DF823B3B53109E142D1C8BA5574D5DEC7F1A14AC23168D97CDC6C83081AD2BAB
    SPKI SHA256: 41CBBDC9ABBFC1BF6A33D2CC331A912487A55DD582B86973C57576FC35619441
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/certumtlseccrootca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/certumtlseccrootca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum DV TLS G3 R39 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum DV TLS G3 R39 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS RSA Root CA
- Serial: FEF18B882025B739BB28B631C8567E12
- SHA-256: 2815EDBD52B749EB9FE1C88FA68B85C8559BEE04FF05D1EE17E0AED8B14308B3
- SPKI SHA-256: 5EB8FAA393F9F447142CB23C0A5A59BA79B82AA3B0401E67E30510791E17FA7B
- Validity: 2024-04-02 to 2039-03-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://crl.certum.pl/certumdvtlsg3r39ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/certumtlsrsarootca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            fe:f1:8b:88:20:25:b7:39:bb:28:b6:31:c8:56:7e:12
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., CN = Certum TLS RSA Root CA
        Validity
            Not Before: Apr  2 11:36:27 2024 GMT
            Not After : Mar 20 11:36:27 2039 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum DV TLS G3 R39 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/certumtlsrsarootca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                EB:34:E4:00:A1:E6:7B:7C:D2:23:F4:CA:D7:4E:C0:CB:85:67:15:76
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/certumtlsrsarootca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                80:58:DE:42:44:22:AB:D8:FC:16:ED:B0:6A:9A:22:20:B6:A3:E0:10
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 2815EDBD52B749EB9FE1C88FA68B85C8559BEE04FF05D1EE17E0AED8B14308B3
    SPKI SHA256: 5EB8FAA393F9F447142CB23C0A5A59BA79B82AA3B0401E67E30510791E17FA7B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/certumtlsrsarootca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/certumtlsrsarootca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum EC-384 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum EC-384 CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: DAFD4BF54121E027D68696225F1FCEE8
- SHA-256: B72450ABF5047A8AF63EC9D87E331484850B1849A2550A82A86DB6B41ED38760
- SPKI SHA-256: DE7B6932E9C44582CE0DE07ABDAB7EEA90C75D6D2A07331DF57BD5CB88553D13
- Validity: 2023-09-19 to 2028-09-19
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/cec384ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            da:fd:4b:f5:41:21:e0:27:d6:86:96:22:5f:1f:ce:e8
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Sep 19 10:00:00 2023 GMT
            Not After : Sep 19 10:00:00 2028 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum EC-384 CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                8D:06:66:74:24:76:3A:F3:89:F7:BC:D6:BD:47:7D:2F:BC:10:5F:4B
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: B72450ABF5047A8AF63EC9D87E331484850B1849A2550A82A86DB6B41ED38760
    SPKI SHA256: DE7B6932E9C44582CE0DE07ABDAB7EEA90C75D6D2A07331DF57BD5CB88553D13
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys
- [current] error e_subj_orgunit_in_ca_cert: The OU attribute in the Subject is prohibited in Root and TLS CA certificates

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum EV TLS G2 E39 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum EV TLS G2 E39 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum EC-384 CA
- Serial: 29B6454D5DA249033BB37AA53717B743
- SHA-256: 3B28121D8985E2DADF2029C53F232007F0C19EC788654B2C2BAAEBE50419B0D5
- SPKI SHA-256: E94E5BA3C8E45FA9AEADFBA7C8C1F8837A9A2B7E7B3D6AEA2C48DC5FF9B7B692
- Validity: 2024-06-18 to 2039-06-05
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://certumevtlsg2e39ca.crl.certum.pl/certumevtlsg2e39ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            29:b6:45:4d:5d:a2:49:03:3b:b3:7a:a5:37:17:b7:43
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum EC-384 CA
        Validity
            Not Before: Jun 18 07:51:55 2024 GMT
            Not After : Jun  5 07:51:55 2039 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum EV TLS G2 E39 CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/cec384ca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8D:06:66:74:24:76:3A:F3:89:F7:BC:D6:BD:47:7D:2F:BC:10:5F:4B
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/cec384ca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                3F:B6:01:75:5A:20:F8:D1:B0:26:94:78:DC:A9:8C:D1:69:0C:D7:B3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 3B28121D8985E2DADF2029C53F232007F0C19EC788654B2C2BAAEBE50419B0D5
    SPKI SHA256: E94E5BA3C8E45FA9AEADFBA7C8C1F8837A9A2B7E7B3D6AEA2C48DC5FF9B7B692
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/cec384ca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum EV TLS G2 R39 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum EV TLS G2 R39 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: C1753CEE5EC5B79144A8E3F3C9DDBF28
- SHA-256: 4736F1ECF26A043CB4D8F94DA8302EA9E45F3D311048F3A400D01AEED1E99444
- SPKI SHA-256: 82A075574305429881093CFE13EF0D70DBF2FD8E1B52483E0726078A4644D96E
- Validity: 2024-06-18 to 2039-06-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://certumevtlsg2r39ca.crl.certum.pl/certumevtlsg2r39ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c1:75:3c:ee:5e:c5:b7:91:44:a8:e3:f3:c9:dd:bf:28
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Jun 18 07:45:09 2024 GMT
            Not After : Jun  5 07:45:09 2039 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum EV TLS G2 R39 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E0:88:FC:58:51:6C:D6:18:98:A6:18:90:65:93:1B:61:D4:E0:BB:18
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 4736F1ECF26A043CB4D8F94DA8302EA9E45F3D311048F3A400D01AEED1E99444
    SPKI SHA256: 82A075574305429881093CFE13EF0D70DBF2FD8E1B52483E0726078A4644D96E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum EV TLS G3 E39 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum EV TLS G3 E39 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS ECC Root CA
- Serial: D954BC236F5761DFEFE1BDBA9ECEF838
- SHA-256: EE2E652AF16790B709041EB9B1430B4A93AA18EC2A2983E6E67137FDE25CD511
- SPKI SHA-256: 187C56809C647E06DE955F302CC338DFF08228EC9A0A99C513AED3C986DFF011
- Validity: 2024-04-02 to 2039-03-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://crl.certum.pl/certumevtlsg3e39ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/certumtlseccrootca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d9:54:bc:23:6f:57:61:df:ef:e1:bd:ba:9e:ce:f8:38
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., CN = Certum TLS ECC Root CA
        Validity
            Not Before: Apr  2 12:30:22 2024 GMT
            Not After : Mar 20 12:30:22 2039 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum EV TLS G3 E39 CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/certumtlseccrootca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                30:BD:17:08:17:FE:B5:10:86:94:0D:78:63:72:6C:58:67:B9:D0:EA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/certumtlseccrootca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                4B:45:4A:D3:02:0E:65:8B:35:34:E8:A4:BE:FF:BD:1E:21:5F:3C:1A
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: EE2E652AF16790B709041EB9B1430B4A93AA18EC2A2983E6E67137FDE25CD511
    SPKI SHA256: 187C56809C647E06DE955F302CC338DFF08228EC9A0A99C513AED3C986DFF011
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/certumtlseccrootca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/certumtlseccrootca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum EV TLS G3 R39 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum EV TLS G3 R39 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS RSA Root CA
- Serial: 64101B2045C0BDF3E6C1F2EA442D2759
- SHA-256: 5C1D0DA0785C1D09E02BFD53C3D3D84D141DE00C01AE2BBF93C539CA87A5FF03
- SPKI SHA-256: 6CEFAB6BBFDAA26B6F3621809EB5E0DD66A964FD8AE14082661805D81AF5A5AB
- Validity: 2024-04-02 to 2039-03-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://crl.certum.pl/certumevtlsg3r39ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/certumtlsrsarootca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            64:10:1b:20:45:c0:bd:f3:e6:c1:f2:ea:44:2d:27:59
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., CN = Certum TLS RSA Root CA
        Validity
            Not Before: Apr  2 11:41:47 2024 GMT
            Not After : Mar 20 11:41:47 2039 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum EV TLS G3 R39 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/certumtlsrsarootca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                EB:34:E4:00:A1:E6:7B:7C:D2:23:F4:CA:D7:4E:C0:CB:85:67:15:76
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/certumtlsrsarootca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E6:E2:66:E4:DD:7B:96:0B:B9:7E:61:A0:45:76:D3:41:A2:DA:D7:46
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 5C1D0DA0785C1D09E02BFD53C3D3D84D141DE00C01AE2BBF93C539CA87A5FF03
    SPKI SHA256: 6CEFAB6BBFDAA26B6F3621809EB5E0DD66A964FD8AE14082661805D81AF5A5AB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/certumtlsrsarootca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/certumtlsrsarootca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum Extended Validation CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Extended Validation CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA 2
- Serial: F18734D48395862A0C3AF6E4B927381A
- SHA-256: 7816C7B0566B46783B1C15D8A28D8B0D20CFEB20B3D13F79446E15C4A51C91DF
- SPKI SHA-256: AF19834886EE88D4BC7F3907AEAC1BE6033C7C65D85D8EC482AE5F2D8C849F8B
- Validity: 2013-01-24 to 2028-01-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/evca2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            f1:87:34:d4:83:95:86:2a:0c:3a:f6:e4:b9:27:38:1a
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA 2
        Validity
            Not Before: Jan 24 11:36:55 2013 GMT
            Not After : Jan 24 11:36:55 2028 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Extended Validation CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                DF:76:C9:E8:1A:C2:F5:27:6B:94:88:3E:E0:75:36:C2:44:6E:5F:67
            X509v3 Authority Key Identifier:
                B6:A1:54:39:02:C3:A0:3F:8E:8A:BC:FA:D4:F8:1C:A6:D1:3A:0E:FD
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 7816C7B0566B46783B1C15D8A28D8B0D20CFEB20B3D13F79446E15C4A51C91DF
    SPKI SHA256: AF19834886EE88D4BC7F3907AEAC1BE6033C7C65D85D8EC482AE5F2D8C849F8B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca2.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_wrong_time_format_pre2050: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum Extended Validation CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Extended Validation CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 06D6EE
- SHA-256: 73BA7942E5187015176F1DFD358D324D7BAF0F98366442154FE72CCB4A6A3C3F
- SPKI SHA-256: 33D8DFBD44CE117A9A91C0A5359874C48096735DAAB82A51F51F25E3515EB692
- Validity: 2009-12-03 to 2024-12-03
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 448238 (0x6d6ee)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Dec  3 12:30:51 2009 GMT
            Not After : Dec  3 12:30:51 2024 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Extended Validation CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                C0:3B:0A:FA:0F:D9:FE:0F:4E:02:98:65:14:0C:8A:1E:2E:00:8C:03
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            Authority Information Access:
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 73BA7942E5187015176F1DFD358D324D7BAF0F98366442154FE72CCB4A6A3C3F
    SPKI SHA256: 33D8DFBD44CE117A9A91C0A5359874C48096735DAAB82A51F51F25E3515EB692
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Certum Extended Validation CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Extended Validation CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 7F510C05CFB39D04FFF306BA2C56E827
- SHA-256: CF1EA15DC9C05ABC72AF0E62C48D93434AE0271B1AA4318BE3544126D24B6184
- SPKI SHA-256: 33D8DFBD44CE117A9A91C0A5359874C48096735DAAB82A51F51F25E3515EB692
- Validity: 2009-12-03 to 2024-12-03
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/evca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:51:0c:05:cf:b3:9d:04:ff:f3:06:ba:2c:56:e8:27
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Dec  3 12:30:51 2009 GMT
            Not After : Dec  3 12:30:51 2024 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Extended Validation CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                C0:3B:0A:FA:0F:D9:FE:0F:4E:02:98:65:14:0C:8A:1E:2E:00:8C:03
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: CF1EA15DC9C05ABC72AF0E62C48D93434AE0271B1AA4318BE3544126D24B6184
    SPKI SHA256: 33D8DFBD44CE117A9A91C0A5359874C48096735DAAB82A51F51F25E3515EB692
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_wrong_time_format_pre2050: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Certum Extended Validation CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Extended Validation CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 047A57
- SHA-256: 2DCAA30575780487B74E5B96E085A624CDAFD9445EEFEBAF5658AC3045F3A521
- SPKI SHA-256: 33D8DFBD44CE117A9A91C0A5359874C48096735DAAB82A51F51F25E3515EB692
- Validity: 2009-03-04 to 2019-03-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 293463 (0x47a57)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Mar  4 14:38:55 2009 GMT
            Not After : Mar  4 14:38:55 2019 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Extended Validation CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                C0:3B:0A:FA:0F:D9:FE:0F:4E:02:98:65:14:0C:8A:1E:2E:00:8C:03
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            Authority Information Access:
                CA Issuers - URI:http://www.certum.pl/ctnca.cer
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/repository/CPS
                  User Notice:
                    Explicit Text: Usage of this certificate is strictly subjected to the CERTUM CPS accessible in the repository at https://www.certum.pl/repository. Copyright (C) 2002-2009 Unizeto Technologies S.A.
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2DCAA30575780487B74E5B96E085A624CDAFD9445EEFEBAF5658AC3045F3A521
    SPKI SHA256: 33D8DFBD44CE117A9A91C0A5359874C48096735DAAB82A51F51F25E3515EB692
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://www.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Certum Extended Validation CA SHA2

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Extended Validation CA SHA2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: C5A2D3F6EB4D193C17A90AA38A296E54
- SHA-256: 6C47D365C13BC8CC3D6DEF5D8F07AB8DBEA3C8D4945D651AA9854A9C9A3CC71C
- SPKI SHA-256: 1D82D7F1FA9711B377367EFEE640C26A06DBCD99D2A17B0FFAB0316D92788AC3
- Validity: 2014-09-11 to 2027-06-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/evcasha2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c5:a2:d3:f6:eb:4d:19:3c:17:a9:0a:a3:8a:29:6e:54
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Sep 11 12:00:00 2014 GMT
            Not After : Jun  9 10:46:39 2027 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Extended Validation CA SHA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                B9:F2:22:D1:20:92:F5:A5:E1:13:75:AE:E0:76:F8:C9:F1:AD:73:8F
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6C47D365C13BC8CC3D6DEF5D8F07AB8DBEA3C8D4945D651AA9854A9C9A3CC71C
    SPKI SHA256: 1D82D7F1FA9711B377367EFEE640C26A06DBCD99D2A17B0FFAB0316D92788AC3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Certum Extended Validation Code Signing 2021 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Extended Validation Code Signing 2021 CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA 2
- Serial: BBF0CCB5B7B831FD21AE32778AE40C89
- SHA-256: D6D9BFA813BFCBAB204C1AE503D2DE4093D2FC0041E365485AD02139F66AA76A
- SPKI SHA-256: F5DA4F4D2E1261D2CD32497F9EE17674B710B7BE86F4A44EFA44314BC4F778DB
- Validity: 2021-05-19 to 2036-05-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/cevcsca2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA 2
        Validity
            Not Before: May 19 05:32:13 2021 GMT
            Not After : May 18 05:32:13 2036 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum Extended Validation Code Signing 2021 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                AC:57:CA:08:16:DC:3F:C5:31:1C:0A:4D:DB:FB:F1:DE:99:27:2D:34
            X509v3 Authority Key Identifier:
                B6:A1:54:39:02:C3:A0:3F:8E:8A:BC:FA:D4:F8:1C:A6:D1:3A:0E:FD
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D6D9BFA813BFCBAB204C1AE503D2DE4093D2FC0041E365485AD02139F66AA76A
    SPKI SHA256: F5DA4F4D2E1261D2CD32497F9EE17674B710B7BE86F4A44EFA44314BC4F778DB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca2.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum Extended Validation Code Signing CA SHA2

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Extended Validation Code Signing CA SHA2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 4E96C1BA06258A0C2ABA27625E9064D3
- SHA-256: 176AAE8BDD5DD06A7DBD42862DC173BD838FFE3013103B097B9671C37BA6AE14
- SPKI SHA-256: 2A6162E44DFC3808BD888B7BE2372DEE22474340126E338EC1D2B9ECE143BBC5
- Validity: 2015-10-29 to 2027-01-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/evcscasha2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4e:96:c1:ba:06:25:8a:0c:2a:ba:27:62:5e:90:64:d3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Oct 29 11:55:39 2015 GMT
            Not After : Jan 19 11:55:39 2027 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Extended Validation Code Signing CA SHA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                A2:C5:2A:11:74:2D:BB:2B:34:44:B5:E3:CE:81:74:68:C2:AA:65:17
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 176AAE8BDD5DD06A7DBD42862DC173BD838FFE3013103B097B9671C37BA6AE14
    SPKI SHA256: 2A6162E44DFC3808BD888B7BE2372DEE22474340126E338EC1D2B9ECE143BBC5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Certum Extended Validation ECC CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Extended Validation ECC CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum EC-384 CA
- Serial: 63B4FBE02028AA507D9293416FF4104F
- SHA-256: C7063A8DC668205E66153108FBE3BDBF6EDB6F8CE5F616A369BEF6324DCB6354
- SPKI SHA-256: FF221DFBB8B12530344628D1763AF848680A7A35C684B6874B1323BD9C6831E0
- Validity: 2019-10-17 to 2034-10-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://eveccca.crl.certum.pl/eveccca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            63:b4:fb:e0:20:28:aa:50:7d:92:93:41:6f:f4:10:4f
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum EC-384 CA
        Validity
            Not Before: Oct 17 10:34:06 2019 GMT
            Not After : Oct 17 10:34:06 2034 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Extended Validation ECC CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                1C:E1:4E:22:49:74:57:E9:2B:BF:99:E1:2A:56:0B:62:DC:A1:E2:A3
            X509v3 Authority Key Identifier:
                8D:06:66:74:24:76:3A:F3:89:F7:BC:D6:BD:47:7D:2F:BC:10:5F:4B
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/cec384ca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/cec384ca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C7063A8DC668205E66153108FBE3BDBF6EDB6F8CE5F616A369BEF6324DCB6354
    SPKI SHA256: FF221DFBB8B12530344628D1763AF848680A7A35C684B6874B1323BD9C6831E0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/cec384ca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum Extended Validation RSA CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Extended Validation RSA CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 239C8D41DD60D04EA6A32FE004A9E85D
- SHA-256: 1C4EEA3A47ABD122568EAB547E06B52111F7F388662C246C8ECBE2660B9F26F1
- SPKI SHA-256: 600A0A87F5A94E8723ACDC3EFE6C4EBD1273EB9087539C9D438F9193E959AD15
- Validity: 2019-10-17 to 2034-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://evrsaca.crl.certum.pl/evrsaca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            23:9c:8d:41:dd:60:d0:4e:a6:a3:2f:e0:04:a9:e8:5d
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Oct 17 10:23:56 2019 GMT
            Not After : Oct 17 10:23:56 2034 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Extended Validation RSA CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                4E:08:95:8E:4B:C3:23:EB:A3:3A:18:CA:B8:36:AF:D6:64:99:12:C9
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctrca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 1C4EEA3A47ABD122568EAB547E06B52111F7F388662C246C8ECBE2660B9F26F1
    SPKI SHA256: 600A0A87F5A94E8723ACDC3EFE6C4EBD1273EB9087539C9D438F9193E959AD15
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum Global Services CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA
- Issuer: countryName=PL, organizationName=Unizeto Sp. z o.o., commonName=Certum CA
- Serial: C53C18BF8F3F9CC77306A9C6A13E84E7
- SHA-256: 2E481FF3A53D293BD49F3CD83976583682B3BD79A160FD6E9CA58725D93B945B
- SPKI SHA-256: B4D31633D83B3105CD26915F7C0E6BF8A0E38959A65EB6D83DD42F56D391A48E
- Validity: 2009-03-03 to 2024-03-03
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/gsca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c5:3c:18:bf:8f:3f:9c:c7:73:06:a9:c6:a1:3e:84:e7
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Sp. z o.o., CN = Certum CA
        Validity
            Not Before: Mar  3 13:06:12 2009 GMT
            Not After : Mar  3 13:06:12 2024 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                45:C5:B2:86:4E:CC:DD:29:97:E4:DD:14:C4:6E:AE:4D:B8:C1:77:F8
            X509v3 Authority Key Identifier:
                DirName:/C=PL/O=Unizeto Sp. z o.o./CN=Certum CA
                serial:01:00:20
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2E481FF3A53D293BD49F3CD83976583682B3BD79A160FD6E9CA58725D93B945B
    SPKI SHA256: B4D31633D83B3105CD26915F7C0E6BF8A0E38959A65EB6D83DD42F56D391A48E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ca.cer
- CRL Distribution Points: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_authority_key_identifier_no_key_identifier: 
- [historical] error e_wrong_time_format_pre2050: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Certum Global Services CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA
- Issuer: countryName=PL, organizationName=Unizeto Sp. z o.o., commonName=Certum CA
- Serial: 490239015A0DCC0177396CA23360A3E258DE142D
- SHA-256: E71DB3A6FE82C4C8B78A6D6A5BEFDA5279082E2FAC0CC7EE7878C04AC9A59263
- SPKI SHA-256: B4D31633D83B3105CD26915F7C0E6BF8A0E38959A65EB6D83DD42F56D391A48E
- Validity: 2009-03-03 to 2024-03-03
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            49:02:39:01:5a:0d:cc:01:77:39:6c:a2:33:60:a3:e2:58:de:14:2d
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Sp. z o.o., CN = Certum CA
        Validity
            Not Before: Mar  3 13:06:12 2009 GMT
            Not After : Mar  3 13:06:12 2024 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                45:C5:B2:86:4E:CC:DD:29:97:E4:DD:14:C4:6E:AE:4D:B8:C1:77:F8
            X509v3 Authority Key Identifier:
                DirName:/C=PL/O=Unizeto Sp. z o.o./CN=Certum CA
                serial:01:00:20
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ca.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E71DB3A6FE82C4C8B78A6D6A5BEFDA5279082E2FAC0CC7EE7878C04AC9A59263
    SPKI SHA256: B4D31633D83B3105CD26915F7C0E6BF8A0E38959A65EB6D83DD42F56D391A48E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_authority_key_identifier_no_key_identifier: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Certum Global Services CA SHA2

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: D04B6FE5DD5BD221E7C74CF6468B3146
- SHA-256: 9E852C59DFC6FD6ABD4E17EA80B5F4E56FC04192D107258D54DA8A92528670D6
- SPKI SHA-256: 33B683FC79A0CBB085F2C4DD76BE6CA3531958406E35F2C87467B58EFCB45FA1
- Validity: 2014-09-11 to 2027-06-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/gscasha2.crl, http://subca.crl.certum.pl/gscasha2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d0:4b:6f:e5:dd:5b:d2:21:e7:c7:4c:f6:46:8b:31:46
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Sep 11 12:00:00 2014 GMT
            Not After : Jun  9 10:46:39 2027 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9E852C59DFC6FD6ABD4E17EA80B5F4E56FC04192D107258D54DA8A92528670D6
    SPKI SHA256: 33B683FC79A0CBB085F2C4DD76BE6CA3531958406E35F2C87467B58EFCB45FA1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Certum Global Services SMIME RSA CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Global Services SMIME RSA CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 0BA3582EDD7AB32A93A1E32B27D04ACA
- SHA-256: 41C7155655F8DC27BA1128248980067D46836B6450CF4E1062C8C2772606773F
- SPKI SHA-256: D1D8CE17255815D0E60DD538A36076B077BFA524F9106B91808D8DBB34918FF2
- Validity: 2023-08-08 to 2038-07-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/cgssmimersaca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0b:a3:58:2e:dd:7a:b3:2a:93:a1:e3:2b:27:d0:4a:ca
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Aug  8 06:29:49 2023 GMT
            Not After : Jul 30 06:29:49 2038 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum Global Services SMIME RSA CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                7F:9D:5C:72:FF:6C:3A:FF:28:27:DB:C1:29:16:72:4E:61:19:E9:08
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctrca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctrca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 41C7155655F8DC27BA1128248980067D46836B6450CF4E1062C8C2772606773F
    SPKI SHA256: D1D8CE17255815D0E60DD538A36076B077BFA524F9106B91808D8DBB34918FF2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum KWT G1 R29 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum KWT G1 R29 CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 58217C271F3FFC8C7F68EDB91A3752B9
- SHA-256: 4B3827B06C626CD2DFCE51CAA831D07B02417DFDB995F194FBACB6767C1EE681
- SPKI SHA-256: B706A314E9CB93D8704244BAD1CE4CCD63D52E223D8D31AA89D44847B4C89930
- Validity: 2026-02-18 to 2029-12-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://certumkwtg1r29ca.crl.certum.pl/certumkwtg1r29ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            58:21:7c:27:1f:3f:fc:8c:7f:68:ed:b9:1a:37:52:b9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Feb 18 08:37:21 2026 GMT
            Not After : Dec 20 08:37:21 2029 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum KWT G1 R29 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctnca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                06:D0:85:26:DD:4E:A1:4A:CD:04:D2:FB:D4:5C:1E:F6:A9:C3:E8:11
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4B3827B06C626CD2DFCE51CAA831D07B02417DFDB995F194FBACB6767C1EE681
    SPKI SHA256: B706A314E9CB93D8704244BAD1CE4CCD63D52E223D8D31AA89D44847B4C89930
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum Level I CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Level I CA
- Issuer: countryName=PL, organizationName=Unizeto Sp. z o.o., commonName=Certum CA
- Serial: 0DE21C3CA714FE4B0A64AC469B1AACCC
- SHA-256: 55BB45D85F2157403DB9BAA033ED2CAD7EC9A0C490CC4C5CA8C5399E6EACB7D0
- SPKI SHA-256: 7548E568CD2A00D1BE9C9583B7AAC00732C80F84977E94397F3AAF17C07BF8F7
- Validity: 2009-03-03 to 2024-03-03
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/l1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0d:e2:1c:3c:a7:14:fe:4b:0a:64:ac:46:9b:1a:ac:cc
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Sp. z o.o., CN = Certum CA
        Validity
            Not Before: Mar  3 12:52:30 2009 GMT
            Not After : Mar  3 12:52:30 2024 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Level I CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                C6:05:BD:63:1D:E2:D8:6E:28:36:1F:45:EE:35:3C:C9:7F:72:CA:3B
            X509v3 Authority Key Identifier:
                DirName:/C=PL/O=Unizeto Sp. z o.o./CN=Certum CA
                serial:01:00:20
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 55BB45D85F2157403DB9BAA033ED2CAD7EC9A0C490CC4C5CA8C5399E6EACB7D0
    SPKI SHA256: 7548E568CD2A00D1BE9C9583B7AAC00732C80F84977E94397F3AAF17C07BF8F7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ca.cer
- CRL Distribution Points: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_authority_key_identifier_no_key_identifier: 
- [historical] error e_wrong_time_format_pre2050: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Certum Level I CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Level I CA
- Issuer: countryName=PL, organizationName=Unizeto Sp. z o.o., commonName=Certum CA
- Serial: 047A51
- SHA-256: D84C21D568BCADFEF335DC897D9B6F9D8059782F9BA05113CC45923BF9C98969
- SPKI SHA-256: 7548E568CD2A00D1BE9C9583B7AAC00732C80F84977E94397F3AAF17C07BF8F7
- Validity: 2009-03-03 to 2024-03-03
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 293457 (0x47a51)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Sp. z o.o., CN = Certum CA
        Validity
            Not Before: Mar  3 12:52:30 2009 GMT
            Not After : Mar  3 12:52:30 2024 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Level I CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                C6:05:BD:63:1D:E2:D8:6E:28:36:1F:45:EE:35:3C:C9:7F:72:CA:3B
            X509v3 Authority Key Identifier:
                DirName:/C=PL/O=Unizeto Sp. z o.o./CN=Certum CA
                serial:01:00:20
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ca.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D84C21D568BCADFEF335DC897D9B6F9D8059782F9BA05113CC45923BF9C98969
    SPKI SHA256: 7548E568CD2A00D1BE9C9583B7AAC00732C80F84977E94397F3AAF17C07BF8F7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_authority_key_identifier_no_key_identifier: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Certum Level II CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Level II CA
- Issuer: countryName=PL, organizationName=Unizeto Sp. z o.o., commonName=Certum CA
- Serial: 770AC6C2BA51A41C1D5D2F99B26B0C1A
- SHA-256: FE716FF3996CD6561B6B63A8C440FDF5489CF48F7834283EEBD19B380F3FBC22
- SPKI SHA-256: 405C2DC2933AC5AD5D5523844F3E59440804DF720FB04760AB9FB821B621DA25
- Validity: 2009-03-03 to 2024-03-03
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/l2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:0a:c6:c2:ba:51:a4:1c:1d:5d:2f:99:b2:6b:0c:1a
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Sp. z o.o., CN = Certum CA
        Validity
            Not Before: Mar  3 12:53:18 2009 GMT
            Not After : Mar  3 12:53:18 2024 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Level II CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                80:62:11:DE:C0:6B:A7:10:E1:08:F0:55:B4:30:83:BF:FA:8F:08:60
            X509v3 Authority Key Identifier:
                DirName:/C=PL/O=Unizeto Sp. z o.o./CN=Certum CA
                serial:01:00:20
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FE716FF3996CD6561B6B63A8C440FDF5489CF48F7834283EEBD19B380F3FBC22
    SPKI SHA256: 405C2DC2933AC5AD5D5523844F3E59440804DF720FB04760AB9FB821B621DA25
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ca.cer
- CRL Distribution Points: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_authority_key_identifier_no_key_identifier: 
- [historical] error e_wrong_time_format_pre2050: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Certum Level II CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Level II CA
- Issuer: countryName=PL, organizationName=Unizeto Sp. z o.o., commonName=Certum CA
- Serial: 047A52
- SHA-256: 4AA4641706D04220B6BB08ADD302094E56BFCACF145D623E3AE8AAE72E0E1DFA
- SPKI SHA-256: 405C2DC2933AC5AD5D5523844F3E59440804DF720FB04760AB9FB821B621DA25
- Validity: 2009-03-03 to 2024-03-03
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 293458 (0x47a52)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Sp. z o.o., CN = Certum CA
        Validity
            Not Before: Mar  3 12:53:18 2009 GMT
            Not After : Mar  3 12:53:18 2024 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Level II CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                80:62:11:DE:C0:6B:A7:10:E1:08:F0:55:B4:30:83:BF:FA:8F:08:60
            X509v3 Authority Key Identifier:
                DirName:/C=PL/O=Unizeto Sp. z o.o./CN=Certum CA
                serial:01:00:20
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ca.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4AA4641706D04220B6BB08ADD302094E56BFCACF145D623E3AE8AAE72E0E1DFA
    SPKI SHA256: 405C2DC2933AC5AD5D5523844F3E59440804DF720FB04760AB9FB821B621DA25
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_authority_key_identifier_no_key_identifier: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Certum Level III CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Level III CA
- Issuer: countryName=PL, organizationName=Unizeto Sp. z o.o., commonName=Certum CA
- Serial: 047A53
- SHA-256: 5735A8D44CF917B4D1475673629C5E094D02C1767C43DCA7991CF1FFAE4E72DA
- SPKI SHA-256: 0D3EFB8F112406F0DD5A42C6CE47F9635FD580E14ECD575A27DBA440EC243FC4
- Validity: 2009-03-03 to 2024-03-03
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 293459 (0x47a53)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Sp. z o.o., CN = Certum CA
        Validity
            Not Before: Mar  3 12:53:56 2009 GMT
            Not After : Mar  3 12:53:56 2024 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Level III CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                04:C9:DA:9A:DC:4A:49:77:AF:30:03:04:66:2E:C7:CE:F2:F8:17:7D
            X509v3 Authority Key Identifier:
                DirName:/C=PL/O=Unizeto Sp. z o.o./CN=Certum CA
                serial:01:00:20
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ca.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5735A8D44CF917B4D1475673629C5E094D02C1767C43DCA7991CF1FFAE4E72DA
    SPKI SHA256: 0D3EFB8F112406F0DD5A42C6CE47F9635FD580E14ECD575A27DBA440EC243FC4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_authority_key_identifier_no_key_identifier: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Certum Level III CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Level III CA
- Issuer: countryName=PL, organizationName=Unizeto Sp. z o.o., commonName=Certum CA
- Serial: 64FE29DCCF38E030DCFFE34D05689661
- SHA-256: DE8A6FD403447319FB31B471A9468A00A87DEDC062E6970D770A51603832688C
- SPKI SHA-256: 0D3EFB8F112406F0DD5A42C6CE47F9635FD580E14ECD575A27DBA440EC243FC4
- Validity: 2009-03-03 to 2024-03-03
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/l3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            64:fe:29:dc:cf:38:e0:30:dc:ff:e3:4d:05:68:96:61
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Sp. z o.o., CN = Certum CA
        Validity
            Not Before: Mar  3 12:53:56 2009 GMT
            Not After : Mar  3 12:53:56 2024 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Level III CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                04:C9:DA:9A:DC:4A:49:77:AF:30:03:04:66:2E:C7:CE:F2:F8:17:7D
            X509v3 Authority Key Identifier:
                DirName:/C=PL/O=Unizeto Sp. z o.o./CN=Certum CA
                serial:01:00:20
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: DE8A6FD403447319FB31B471A9468A00A87DEDC062E6970D770A51603832688C
    SPKI SHA256: 0D3EFB8F112406F0DD5A42C6CE47F9635FD580E14ECD575A27DBA440EC243FC4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ca.cer
- CRL Distribution Points: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_authority_key_identifier_no_key_identifier: 
- [historical] error e_wrong_time_format_pre2050: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Certum Level IV CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Level IV CA
- Issuer: countryName=PL, organizationName=Unizeto Sp. z o.o., commonName=Certum CA
- Serial: 047A54
- SHA-256: 4B890BFBBE669090928707351DE6149765AEFC5505B203B305A9E57FE6C089A9
- SPKI SHA-256: F81D03826281E61584B8789BD349B68EF08958194E608D0D193326563695AC90
- Validity: 2009-03-03 to 2024-03-03
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 293460 (0x47a54)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Sp. z o.o., CN = Certum CA
        Validity
            Not Before: Mar  3 12:54:25 2009 GMT
            Not After : Mar  3 12:54:25 2024 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Level IV CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                CD:4A:46:CA:03:65:90:E6:31:10:1A:82:C6:A5:1C:5E:D1:50:CF:1F
            X509v3 Authority Key Identifier:
                DirName:/C=PL/O=Unizeto Sp. z o.o./CN=Certum CA
                serial:01:00:20
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ca.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4B890BFBBE669090928707351DE6149765AEFC5505B203B305A9E57FE6C089A9
    SPKI SHA256: F81D03826281E61584B8789BD349B68EF08958194E608D0D193326563695AC90
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_authority_key_identifier_no_key_identifier: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Certum Level IV CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Level IV CA
- Issuer: countryName=PL, organizationName=Unizeto Sp. z o.o., commonName=Certum CA
- Serial: 4CA5FEC6617C48B056382A8280E0508C
- SHA-256: 14239787E8FEC7DFFA5F4C570B721B96C169ACCA3F4E95BC3057A3F8A60D7EEF
- SPKI SHA-256: F81D03826281E61584B8789BD349B68EF08958194E608D0D193326563695AC90
- Validity: 2009-03-03 to 2024-03-03
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/l4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4c:a5:fe:c6:61:7c:48:b0:56:38:2a:82:80:e0:50:8c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Sp. z o.o., CN = Certum CA
        Validity
            Not Before: Mar  3 12:54:25 2009 GMT
            Not After : Mar  3 12:54:25 2024 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Level IV CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                CD:4A:46:CA:03:65:90:E6:31:10:1A:82:C6:A5:1C:5E:D1:50:CF:1F
            X509v3 Authority Key Identifier:
                DirName:/C=PL/O=Unizeto Sp. z o.o./CN=Certum CA
                serial:01:00:20
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 14239787E8FEC7DFFA5F4C570B721B96C169ACCA3F4E95BC3057A3F8A60D7EEF
    SPKI SHA256: F81D03826281E61584B8789BD349B68EF08958194E608D0D193326563695AC90
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ca.cer
- CRL Distribution Points: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_authority_key_identifier_no_key_identifier: 
- [historical] error e_wrong_time_format_pre2050: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Certum Organization Validation CA SHA2

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Organization Validation CA SHA2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: B5AD0F63854CC4622E4B3923B2900216
- SHA-256: FD02362244F31266CAFF005818D1004EC4EB08FB239AAFAAAFFF47497D6005D6
- SPKI SHA-256: E751AF78A36BA498ED1A95D8E500F1D37B3761343069089CE9D581AA8DF35FAB
- Validity: 2014-09-11 to 2027-06-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/ovcasha2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b5:ad:0f:63:85:4c:c4:62:2e:4b:39:23:b2:90:02:16
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Sep 11 12:00:00 2014 GMT
            Not After : Jun  9 10:46:39 2027 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Organization Validation CA SHA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                EE:ED:E8:54:60:13:0B:35:83:A0:FA:6B:7A:46:3A:F7:3E:30:BB:66
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FD02362244F31266CAFF005818D1004EC4EB08FB239AAFAAAFFF47497D6005D6
    SPKI SHA256: E751AF78A36BA498ED1A95D8E500F1D37B3761343069089CE9D581AA8DF35FAB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Certum OV TLS G2 E39 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum OV TLS G2 E39 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum EC-384 CA
- Serial: 2C036155FFFDE985CB7A0511D34E6102
- SHA-256: A248F04C5529A4CD1DAECA8177B7546530625E3018BCC5A53F647F9F587497B1
- SPKI SHA-256: 590824A581D9E3F91EF68D3D4D40F9ADF7A1F7447F206CAA4B84A50F50DD2D30
- Validity: 2024-06-18 to 2039-06-05
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://certumovtlsg2e39ca.crl.certum.pl/certumovtlsg2e39ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2c:03:61:55:ff:fd:e9:85:cb:7a:05:11:d3:4e:61:02
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum EC-384 CA
        Validity
            Not Before: Jun 18 07:51:13 2024 GMT
            Not After : Jun  5 07:51:13 2039 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum OV TLS G2 E39 CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/cec384ca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8D:06:66:74:24:76:3A:F3:89:F7:BC:D6:BD:47:7D:2F:BC:10:5F:4B
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/cec384ca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                55:1D:6A:31:B1:C0:90:90:A3:5F:D9:05:2B:47:90:78:91:E4:B1:3D
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: A248F04C5529A4CD1DAECA8177B7546530625E3018BCC5A53F647F9F587497B1
    SPKI SHA256: 590824A581D9E3F91EF68D3D4D40F9ADF7A1F7447F206CAA4B84A50F50DD2D30
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/cec384ca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum OV TLS G2 R39 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum OV TLS G2 R39 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 2F7B22589A0DFCE2307C2CD6410DA5D1
- SHA-256: F54CE21EA0F79548F1201A619049CA15F065E49A69F26FB9CF1282C7EECF9C4C
- SPKI SHA-256: 4A81429B8AA84208F687B55990F66E825288D7EC130ACE229AF0A8F05D10AC85
- Validity: 2024-06-18 to 2039-06-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://certumovtlsg2r39ca.crl.certum.pl/certumovtlsg2r39ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2f:7b:22:58:9a:0d:fc:e2:30:7c:2c:d6:41:0d:a5:d1
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Jun 18 07:43:39 2024 GMT
            Not After : Jun  5 07:43:39 2039 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum OV TLS G2 R39 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E8:79:07:6D:8D:83:FB:9A:79:63:63:BC:A5:32:63:B3:05:41:72:A9
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: F54CE21EA0F79548F1201A619049CA15F065E49A69F26FB9CF1282C7EECF9C4C
    SPKI SHA256: 4A81429B8AA84208F687B55990F66E825288D7EC130ACE229AF0A8F05D10AC85
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum OV TLS G3 E39 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum OV TLS G3 E39 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS ECC Root CA
- Serial: 96B1E28A1B77243CC24B723EFECBCDB2
- SHA-256: DD9FA363315EAD6D110C94BAFD2AA61929E41B63A5877FFE84F50FBC36422A65
- SPKI SHA-256: A7D7EC6D8C89EC8C9B919CCD31DDEFF7773E4154D885D9D22DC0F365DD3D3475
- Validity: 2024-04-02 to 2039-03-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://crl.certum.pl/certumovtlsg3e39ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/certumtlseccrootca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            96:b1:e2:8a:1b:77:24:3c:c2:4b:72:3e:fe:cb:cd:b2
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., CN = Certum TLS ECC Root CA
        Validity
            Not Before: Apr  2 12:29:14 2024 GMT
            Not After : Mar 20 12:29:14 2039 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum OV TLS G3 E39 CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/certumtlseccrootca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                30:BD:17:08:17:FE:B5:10:86:94:0D:78:63:72:6C:58:67:B9:D0:EA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/certumtlseccrootca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                C0:E5:59:B6:12:58:0D:BE:3B:91:EB:88:13:C1:75:D0:A1:9A:53:C0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: DD9FA363315EAD6D110C94BAFD2AA61929E41B63A5877FFE84F50FBC36422A65
    SPKI SHA256: A7D7EC6D8C89EC8C9B919CCD31DDEFF7773E4154D885D9D22DC0F365DD3D3475
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/certumtlseccrootca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/certumtlseccrootca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum OV TLS G3 R39 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum OV TLS G3 R39 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS RSA Root CA
- Serial: B9961C58D6D4220E1B19BF59F82A409F
- SHA-256: F447B8DBA8F73A5A2236B73DB6173BBDB3A17626F4F1CC7087092427B5C0F67F
- SPKI SHA-256: A0398DF042D1D3FB3A83FEA43B2771B594697DF84AE683BC9B5872306B5BADE8
- Validity: 2024-04-02 to 2039-03-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://crl.certum.pl/certumovtlsg3r39ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/certumtlsrsarootca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b9:96:1c:58:d6:d4:22:0e:1b:19:bf:59:f8:2a:40:9f
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., CN = Certum TLS RSA Root CA
        Validity
            Not Before: Apr  2 11:40:04 2024 GMT
            Not After : Mar 20 11:40:04 2039 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum OV TLS G3 R39 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/certumtlsrsarootca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                EB:34:E4:00:A1:E6:7B:7C:D2:23:F4:CA:D7:4E:C0:CB:85:67:15:76
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/certumtlsrsarootca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                52:46:3F:DC:DD:81:B3:43:4B:15:B4:F2:AB:ED:24:73:1C:A7:E3:F2
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: F447B8DBA8F73A5A2236B73DB6173BBDB3A17626F4F1CC7087092427B5C0F67F
    SPKI SHA256: A0398DF042D1D3FB3A83FEA43B2771B594697DF84AE683BC9B5872306B5BADE8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/certumtlsrsarootca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/certumtlsrsarootca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum Partners CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Partners CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 047A58
- SHA-256: A6CA043D5C838DD10E935ACDD1079C9686B6511FAF4C80C4DCFC9C54394DED5E
- SPKI SHA-256: B4D31633D83B3105CD26915F7C0E6BF8A0E38959A65EB6D83DD42F56D391A48E
- Validity: 2009-03-03 to 2024-03-03
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 293464 (0x47a58)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Mar  3 13:06:12 2009 GMT
            Not After : Mar  3 13:06:12 2024 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Partners CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                45:C5:B2:86:4E:CC:DD:29:97:E4:DD:14:C4:6E:AE:4D:B8:C1:77:F8
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A6CA043D5C838DD10E935ACDD1079C9686B6511FAF4C80C4DCFC9C54394DED5E
    SPKI SHA256: B4D31633D83B3105CD26915F7C0E6BF8A0E38959A65EB6D83DD42F56D391A48E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Certum SMIME ECC CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum SMIME ECC CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum EC-384 CA
- Serial: 8A2527AD93733CC2276C488C437433B2
- SHA-256: 1131362B431A474A0BC5F2BFEC5B3CC5B5D5E1BDE9FAE64C50AC8E26CE295B56
- SPKI SHA-256: 594B0540B788B5B32D9A1A0DD00F493FC563B3480341E7271EC46F6E947018F7
- Validity: 2023-08-01 to 2038-07-23
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://csmimeeccca.crl.certum.pl/csmimeeccca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            8a:25:27:ad:93:73:3c:c2:27:6c:48:8c:43:74:33:b2
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum EC-384 CA
        Validity
            Not Before: Aug  1 08:18:33 2023 GMT
            Not After : Jul 23 08:18:33 2038 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum SMIME ECC CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                49:97:92:70:52:22:7E:31:3F:C3:41:5B:31:F7:92:AD:03:AA:06:93
            X509v3 Authority Key Identifier:
                8D:06:66:74:24:76:3A:F3:89:F7:BC:D6:BD:47:7D:2F:BC:10:5F:4B
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/cec384ca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/cec384ca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1131362B431A474A0BC5F2BFEC5B3CC5B5D5E1BDE9FAE64C50AC8E26CE295B56
    SPKI SHA256: 594B0540B788B5B32D9A1A0DD00F493FC563B3480341E7271EC46F6E947018F7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/cec384ca.cer
- CRL Distribution Points: http://crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum SMIME G1 R36 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum SMIME G1 R36 CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA 2
- Serial: 61A5CA753C7348A25C254BFDF60946DE
- SHA-256: 61797A30208FA51A11951A7787456E32D7838B9749A00E63971B23D714CD48DF
- SPKI SHA-256: 437B9BA1596BF75DAF0F4D236B3C015B3EE2240F64C828A97620B79CB3B8C16F
- Validity: 2026-02-18 to 2036-02-06
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://certumsmimeg1r36ca.crl.certum.pl/certumsmimeg1r36ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:a5:ca:75:3c:73:48:a2:5c:25:4b:fd:f6:09:46:de
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA 2
        Validity
            Not Before: Feb 18 08:40:47 2026 GMT
            Not After : Feb  6 08:40:47 2036 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum SMIME G1 R36 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctnca2.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                B6:A1:54:39:02:C3:A0:3F:8E:8A:BC:FA:D4:F8:1C:A6:D1:3A:0E:FD
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca2.crl
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                80:87:D3:3E:46:EA:DB:F2:71:0C:89:A3:4D:ED:DF:5B:35:16:E4:7B
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 61797A30208FA51A11951A7787456E32D7838B9749A00E63971B23D714CD48DF
    SPKI SHA256: 437B9BA1596BF75DAF0F4D236B3C015B3EE2240F64C828A97620B79CB3B8C16F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctnca2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum SMIME G1 R36 CA 2

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum SMIME G1 R36 CA 2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA 2
- Serial: 5E5904A370C6269E60593C0FF1E72CBD
- SHA-256: 11EE35B46FDACBD2EDE0D3543811B400612D029DDEEAB473E25FA3F8B259DD66
- SPKI SHA-256: A47F793F103D20C20C50649EF0F2DCBD35530611041D18130EAF6FC505C63E31
- Validity: 2026-03-05 to 2036-02-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://certumsmimeg1r36ca2.crl.certum.pl/certumsmimeg1r36ca2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5e:59:04:a3:70:c6:26:9e:60:59:3c:0f:f1:e7:2c:bd
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA 2
        Validity
            Not Before: Mar  5 08:28:57 2026 GMT
            Not After : Feb 21 08:28:57 2036 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum SMIME G1 R36 CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctnca2.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                B6:A1:54:39:02:C3:A0:3F:8E:8A:BC:FA:D4:F8:1C:A6:D1:3A:0E:FD
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca2.crl
            X509v3 Extended Key Usage:
                E-mail Protection, TLS Web Client Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                25:E4:6B:05:7E:F1:42:01:C8:90:BD:68:24:C0:38:D1:75:BA:9A:34
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 11EE35B46FDACBD2EDE0D3543811B400612D029DDEEAB473E25FA3F8B259DD66
    SPKI SHA256: A47F793F103D20C20C50649EF0F2DCBD35530611041D18130EAF6FC505C63E31
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctnca2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum SMIME RSA CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum SMIME RSA CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 0CE13227A82CE6A3D0F357C36CB61E86
- SHA-256: ABC27367A236EC90F91B6457CBAEF942BF657C9C97E87F4A2CC8302160A67AB8
- SPKI SHA-256: 9A4E69D741D82F2424084501218C4ABA3E048F46A706F32C9E1507288537F15F
- Validity: 2023-08-01 to 2038-07-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://csmimersaca.crl.certum.pl/csmimersaca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0c:e1:32:27:a8:2c:e6:a3:d0:f3:57:c3:6c:b6:1e:86
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Aug  1 08:09:49 2023 GMT
            Not After : Jul 23 08:09:49 2038 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum SMIME RSA CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                66:FB:C3:0F:BE:F4:BF:E0:9C:C9:AB:4D:DE:47:19:BD:C0:CA:A6:68
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctrca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctrca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: ABC27367A236EC90F91B6457CBAEF942BF657C9C97E87F4A2CC8302160A67AB8
    SPKI SHA256: 9A4E69D741D82F2424084501218C4ABA3E048F46A706F32C9E1507288537F15F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum Timestamping 2021 CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Timestamping 2021 CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA 2
- Serial: E7FF69C73B35CE4B9126D8747C68A587
- SHA-256: F882EFFC16DE28D508C092E35825B00242CF963071C279EF09310D9D95784B35
- SPKI SHA-256: 308D118FAE3DB23F514FDD10984DB28BAB2F98CCA631619964FB51169B3A1D21
- Validity: 2021-05-19 to 2036-05-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/ctsca2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA 2
        Validity
            Not Before: May 19 05:32:07 2021 GMT
            Not After : May 18 05:32:07 2036 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum Timestamping 2021 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                BE:54:02:2F:BF:40:6C:73:43:CE:AC:09:25:4E:9E:43:44:1A:EE:E0
            X509v3 Authority Key Identifier:
                B6:A1:54:39:02:C3:A0:3F:8E:8A:BC:FA:D4:F8:1C:A6:D1:3A:0E:FD
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: F882EFFC16DE28D508C092E35825B00242CF963071C279EF09310D9D95784B35
    SPKI SHA256: 308D118FAE3DB23F514FDD10984DB28BAB2F98CCA631619964FB51169B3A1D21
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca2.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum TLS ECC Root CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS ECC Root CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: AA34757C5326F6501494EF9503A53AF6
- SHA-256: BC6C7755697594592C22CE1F8C7085D3C49BF41B126A6671FE5EF10F9DE8EFD6
- SPKI SHA-256: DDF469B7A279BB252D97EE2D3B0ABF60F60D0FA54918AA95D30235800F9CDA1A
- Validity: 2026-06-08 to 2029-12-30
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/certumtlseccrootca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            aa:34:75:7c:53:26:f6:50:14:94:ef:95:03:a5:3a:f6
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Jun  8 11:29:50 2026 GMT
            Not After : Dec 30 11:29:50 2029 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum TLS ECC Root CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctnca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
            X509v3 Subject Key Identifier:
                30:BD:17:08:17:FE:B5:10:86:94:0D:78:63:72:6C:58:67:B9:D0:EA
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: BC6C7755697594592C22CE1F8C7085D3C49BF41B126A6671FE5EF10F9DE8EFD6
    SPKI SHA256: DDF469B7A279BB252D97EE2D3B0ABF60F60D0FA54918AA95D30235800F9CDA1A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier
- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum TLS ECC Root CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS ECC Root CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum EC-384 CA
- Serial: 68610473EDC55E8616A9E395EFD9BA5C
- SHA-256: 83C18AF3F7BCE7DC7C5A3A51D001A5AB74C359F7476D5BEED8A30730FC9A6C26
- SPKI SHA-256: DDF469B7A279BB252D97EE2D3B0ABF60F60D0FA54918AA95D30235800F9CDA1A
- Validity: 2026-06-08 to 2036-04-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/certumtlseccrootca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            68:61:04:73:ed:c5:5e:86:16:a9:e3:95:ef:d9:ba:5c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum EC-384 CA
        Validity
            Not Before: Jun  8 10:28:39 2026 GMT
            Not After : Apr 15 10:28:39 2036 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum TLS ECC Root CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/cec384ca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8D:06:66:74:24:76:3A:F3:89:F7:BC:D6:BD:47:7D:2F:BC:10:5F:4B
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/cec384ca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
            X509v3 Subject Key Identifier:
                30:BD:17:08:17:FE:B5:10:86:94:0D:78:63:72:6C:58:67:B9:D0:EA
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 83C18AF3F7BCE7DC7C5A3A51D001A5AB74C359F7476D5BEED8A30730FC9A6C26
    SPKI SHA256: DDF469B7A279BB252D97EE2D3B0ABF60F60D0FA54918AA95D30235800F9CDA1A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/cec384ca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier
- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum TLS ECC Root CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS ECC Root CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: A3B6745069731E987A047118B58306CD
- SHA-256: E4EF90ED903DC9876B0A0BC9A8DE21D9FD041E311A160DC7F2DBC7AB987DCA14
- SPKI SHA-256: DDF469B7A279BB252D97EE2D3B0ABF60F60D0FA54918AA95D30235800F9CDA1A
- Validity: 2026-04-29 to 2029-12-30
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/certumtlseccrootca.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            a3:b6:74:50:69:73:1e:98:7a:04:71:18:b5:83:06:cd
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Apr 29 13:37:04 2026 GMT
            Not After : Dec 30 13:37:04 2029 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum TLS ECC Root CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctnca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
            X509v3 Subject Key Identifier:
                30:BD:17:08:17:FE:B5:10:86:94:0D:78:63:72:6C:58:67:B9:D0:EA
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E4EF90ED903DC9876B0A0BC9A8DE21D9FD041E311A160DC7F2DBC7AB987DCA14
    SPKI SHA256: DDF469B7A279BB252D97EE2D3B0ABF60F60D0FA54918AA95D30235800F9CDA1A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier
- [historical] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum TLS ECC Root CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS ECC Root CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum EC-384 CA
- Serial: 0E1C857BDCCF72BEAF2BCF648F857185
- SHA-256: 1E7833B1747EF5BEC06FC2237DB81E91F23DE8161D3759F9A949334F928D5970
- SPKI SHA-256: DDF469B7A279BB252D97EE2D3B0ABF60F60D0FA54918AA95D30235800F9CDA1A
- Validity: 2026-04-29 to 2036-04-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/certumtlseccrootca.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0e:1c:85:7b:dc:cf:72:be:af:2b:cf:64:8f:85:71:85
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum EC-384 CA
        Validity
            Not Before: Apr 29 13:39:20 2026 GMT
            Not After : Apr 15 13:39:20 2036 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum TLS ECC Root CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/cec384ca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8D:06:66:74:24:76:3A:F3:89:F7:BC:D6:BD:47:7D:2F:BC:10:5F:4B
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/cec384ca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
            X509v3 Subject Key Identifier:
                30:BD:17:08:17:FE:B5:10:86:94:0D:78:63:72:6C:58:67:B9:D0:EA
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1E7833B1747EF5BEC06FC2237DB81E91F23DE8161D3759F9A949334F928D5970
    SPKI SHA256: DDF469B7A279BB252D97EE2D3B0ABF60F60D0FA54918AA95D30235800F9CDA1A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/cec384ca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier
- [historical] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum TLS RSA Root CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS RSA Root CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 348FD53B17F7F4768A95350C16B42D
- SHA-256: 233BE834678F98812F503E94D9B521AEAC33AA9BEE1B8BA20CD5B2D98F3398A8
- SPKI SHA-256: 8C8474414760A2F5986F6AC802A66F37EB6B360DD8EE7747A8B6C92F08B34D9E
- Validity: 2026-04-29 to 2036-04-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/certumtlsrsarootca.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            34:8f:d5:3b:17:f7:f4:76:8a:95:35:0c:16:b4:2d
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Apr 29 13:37:59 2026 GMT
            Not After : Apr 15 13:37:59 2036 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum TLS RSA Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
            X509v3 Subject Key Identifier:
                EB:34:E4:00:A1:E6:7B:7C:D2:23:F4:CA:D7:4E:C0:CB:85:67:15:76
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 233BE834678F98812F503E94D9B521AEAC33AA9BEE1B8BA20CD5B2D98F3398A8
    SPKI SHA256: 8C8474414760A2F5986F6AC802A66F37EB6B360DD8EE7747A8B6C92F08B34D9E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum TLS RSA Root CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS RSA Root CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: DD29CF13FE68A3216E47DC61A34A62B1
- SHA-256: 98D88F84159587EFC830BA17AC8E0C807B7A59D560DE49C8592912251C3EC127
- SPKI SHA-256: 8C8474414760A2F5986F6AC802A66F37EB6B360DD8EE7747A8B6C92F08B34D9E
- Validity: 2026-06-08 to 2036-04-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/certumtlsrsarootca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            dd:29:cf:13:fe:68:a3:21:6e:47:dc:61:a3:4a:62:b1
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Jun  8 10:23:26 2026 GMT
            Not After : Apr 15 10:23:26 2036 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum TLS RSA Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
            X509v3 Subject Key Identifier:
                EB:34:E4:00:A1:E6:7B:7C:D2:23:F4:CA:D7:4E:C0:CB:85:67:15:76
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 98D88F84159587EFC830BA17AC8E0C807B7A59D560DE49C8592912251C3EC127
    SPKI SHA256: 8C8474414760A2F5986F6AC802A66F37EB6B360DD8EE7747A8B6C92F08B34D9E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum TLS RSA Root CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS RSA Root CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: F3A6F6602ED93E8AC27163188EC05B8F
- SHA-256: 5806D9DEDA84AE858E6F3D1371E2BD65D0978FD24A1A978CA3510F47217355D9
- SPKI SHA-256: 8C8474414760A2F5986F6AC802A66F37EB6B360DD8EE7747A8B6C92F08B34D9E
- Validity: 2026-06-08 to 2029-12-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/certumtlsrsarootca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            f3:a6:f6:60:2e:d9:3e:8a:c2:71:63:18:8e:c0:5b:8f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Jun  8 10:21:07 2026 GMT
            Not After : Dec 30 10:21:07 2029 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum TLS RSA Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctnca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
            X509v3 Subject Key Identifier:
                EB:34:E4:00:A1:E6:7B:7C:D2:23:F4:CA:D7:4E:C0:CB:85:67:15:76
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 5806D9DEDA84AE858E6F3D1371E2BD65D0978FD24A1A978CA3510F47217355D9
    SPKI SHA256: 8C8474414760A2F5986F6AC802A66F37EB6B360DD8EE7747A8B6C92F08B34D9E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum TLS RSA Root CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum TLS RSA Root CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: CD2656AC6B5B52193AD23AF66D520AA3
- SHA-256: EB0C60FD1BA955591840FB7B563ADB46501BE8E7592964D8FF79D479D3621D10
- SPKI SHA-256: 8C8474414760A2F5986F6AC802A66F37EB6B360DD8EE7747A8B6C92F08B34D9E
- Validity: 2026-04-29 to 2029-12-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/certumtlsrsarootca.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            cd:26:56:ac:6b:5b:52:19:3a:d2:3a:f6:6d:52:0a:a3
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Apr 29 13:34:06 2026 GMT
            Not After : Dec 30 13:34:06 2029 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., CN = Certum TLS RSA Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctnca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
            X509v3 Subject Key Identifier:
                EB:34:E4:00:A1:E6:7B:7C:D2:23:F4:CA:D7:4E:C0:CB:85:67:15:76
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: EB0C60FD1BA955591840FB7B563ADB46501BE8E7592964D8FF79D479D3621D10
    SPKI SHA256: 8C8474414760A2F5986F6AC802A66F37EB6B360DD8EE7747A8B6C92F08B34D9E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum Trusted Network CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Issuer: countryName=PL, organizationName=Unizeto Sp. z o.o., commonName=Certum CA
- Serial: 23E8290D71950418C008597E42F7481B
- SHA-256: 2D87FF20FE8AD2305DFB6F3992867ED2BF4FE3E1346212C4345991AAC02266E9
- SPKI SHA-256: AA2630A7B617B04D0A294BAB7A8CAAA5016E6DBE604837A83A85719FAB667EB5
- Validity: 2008-10-22 to 2025-12-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/ctnca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Sp. z o.o., CN = Certum CA
        Validity
            Not Before: Oct 22 12:07:37 2008 GMT
            Not After : Dec 30 23:59:59 2025 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Authority Key Identifier:
                DirName:/C=PL/O=Unizeto Sp. z o.o./CN=Certum CA
                serial:01:00:20
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2D87FF20FE8AD2305DFB6F3992867ED2BF4FE3E1346212C4345991AAC02266E9
    SPKI SHA256: AA2630A7B617B04D0A294BAB7A8CAAA5016E6DBE604837A83A85719FAB667EB5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ca.cer
- CRL Distribution Points: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_authority_key_identifier_no_key_identifier: 
- [historical] error e_wrong_time_format_pre2050: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Certum Trusted Network CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Issuer: countryName=PL, organizationName=Unizeto Sp. z o.o., commonName=Certum CA
- Serial: 939285400165715F947F288FEFC99B28
- SHA-256: 949424DC2CCAAB5E9E80D66E0E3F7DEEB3201C607D4315EF4C6F2D93A917279D
- SPKI SHA-256: AA2630A7B617B04D0A294BAB7A8CAAA5016E6DBE604837A83A85719FAB667EB5
- Validity: 2008-10-22 to 2027-06-10
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/ctnca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Sp. z o.o., CN = Certum CA
        Validity
            Not Before: Oct 22 12:07:37 2008 GMT
            Not After : Jun 10 10:46:39 2027 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Authority Key Identifier:
                DirName:/C=PL/O=Unizeto Sp. z o.o./CN=Certum CA
                serial:01:00:20
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 949424DC2CCAAB5E9E80D66E0E3F7DEEB3201C607D4315EF4C6F2D93A917279D
    SPKI SHA256: AA2630A7B617B04D0A294BAB7A8CAAA5016E6DBE604837A83A85719FAB667EB5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ca.cer
- CRL Distribution Points: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ext_authority_key_identifier_no_key_identifier: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Certum Trusted Network CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Issuer: countryName=PL, organizationName=Unizeto Sp. z o.o., commonName=Certum CA
- Serial: 071DB8DDABF23F6DD4D452AF401277EB
- SHA-256: 33F959714B8FA7AB272BEA2CA239403A879044D83A8FD008534D7EE65FA0D42B
- SPKI SHA-256: AA2630A7B617B04D0A294BAB7A8CAAA5016E6DBE604837A83A85719FAB667EB5
- Validity: 2008-10-22 to 2025-12-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:1d:b8:dd:ab:f2:3f:6d:d4:d4:52:af:40:12:77:eb
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Sp. z o.o., CN = Certum CA
        Validity
            Not Before: Oct 22 12:07:37 2008 GMT
            Not After : Dec 30 23:59:59 2025 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ca.crl
            X509v3 Subject Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 33F959714B8FA7AB272BEA2CA239403A879044D83A8FD008534D7EE65FA0D42B
    SPKI SHA256: AA2630A7B617B04D0A294BAB7A8CAAA5016E6DBE604837A83A85719FAB667EB5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.certum.pl/ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_authority_key_identifier_no_key_identifier: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- is_expired

### Certum Trusted Network CA 2

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA 2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 1BB58F252ADF23004928C9AE3D7EED27
- SHA-256: 08E7EAC998A62C4155CC4CBC5EDA32F5B41A12C012F29AB3433BD366348149F0
- SPKI SHA-256: 6B3B57E9EC88D1BB3D01637FF33C7698B3C9758255E9F01EA9178F3E7F3B2B52
- Validity: 2021-05-31 to 2029-09-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/ctnca2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: May 31 06:43:06 2021 GMT
            Not After : Sep 17 06:43:06 2029 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                B6:A1:54:39:02:C3:A0:3F:8E:8A:BC:FA:D4:F8:1C:A6:D1:3A:0E:FD
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 08E7EAC998A62C4155CC4CBC5EDA32F5B41A12C012F29AB3433BD366348149F0
    SPKI SHA256: 6B3B57E9EC88D1BB3D01637FF33C7698B3C9758255E9F01EA9178F3E7F3B2B52
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certum Trusted Network CA 2

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA 2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA 2
- Serial: B85914713F57DF8F31C0333DD2D6197A2317B4EB
- SHA-256: 9F8B05137F20ACDE9B996410F4D0BF7971A1006DC99E094C346D279B93CFF7AE
- SPKI SHA-256: 6B3B57E9EC88D1BB3D01637FF33C7698B3C9758255E9F01EA9178F3E7F3B2B52
- Validity: 2011-10-06 to 2046-10-06
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/ctnca2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b8:59:14:71:3f:57:df:8f:31:c0:33:3d:d2:d6:19:7a:23:17:b4:eb
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA 2
        Validity
            Not Before: Oct  6 08:39:56 2011 GMT
            Not After : Oct  6 08:39:56 2046 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                B6:A1:54:39:02:C3:A0:3F:8E:8A:BC:FA:D4:F8:1C:A6:D1:3A:0E:FD
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 9F8B05137F20ACDE9B996410F4D0BF7971A1006DC99E094C346D279B93CFF7AE
    SPKI SHA256: 6B3B57E9EC88D1BB3D01637FF33C7698B3C9758255E9F01EA9178F3E7F3B2B52
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_serial_number_longer_than_20_octets: The DER encoded certificate serial number is 21 octets long. If this is surprising to you, note that DER integers are signed and that SNs that are 20 octets long with an MSB of 1 will be automatically prefixed with 0x00, thus bumping it up to 21 octets long. SN: 00B85914713F57DF8F31C0333DD2D6197A2317B4EB

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage

### Certum Trusted Root CA

- Subject: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: D8E0744B5824919FBD08847DF72020FA
- SHA-256: FB13890C7AB14FF7B94B2714503E31123BFDD340FC4D979743166E0469B47A88
- SPKI SHA-256: 681DC482C296C8402C6EBB20E68309A3BC846523AE34B984A84EE697A3312DB7
- Validity: 2023-09-19 to 2028-09-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/ctrca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d8:e0:74:4b:58:24:91:9f:bd:08:84:7d:f7:20:20:fa
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Sep 19 10:00:00 2023 GMT
            Not After : Sep 19 10:00:00 2028 GMT
        Subject: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: FB13890C7AB14FF7B94B2714503E31123BFDD340FC4D979743166E0469B47A88
    SPKI SHA256: 681DC482C296C8402C6EBB20E68309A3BC846523AE34B984A84EE697A3312DB7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_subj_orgunit_in_ca_cert: The OU attribute in the Subject is prohibited in Root and TLS CA certificates

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Certyfikat SSL

- Subject: countryName=PL, organizationName=home.pl S.A., commonName=Certyfikat SSL
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 311D7EDDE4920208BBD85EF7262BBA
- SHA-256: A95F23B52AF10895886FB65323D29A9876EA7D396F805E4CA280D561C26E3DAD
- SPKI SHA-256: E4F2788C1D6C8C9E64C776B40ECDA7A093DCD3B64E6FFCB5BD1D6D375B7916C4
- Validity: 2016-06-08 to 2026-06-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/hsha2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            31:1d:7e:dd:e4:92:02:08:bb:d8:5e:f7:26:2b:ba
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jun  8 08:01:29 2016 GMT
            Not After : Jun  6 08:01:29 2026 GMT
        Subject: C = PL, O = home.pl S.A., CN = Certyfikat SSL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Subject Key Identifier:
                3D:91:B6:CC:11:7B:EB:E4:66:11:AC:D2:D2:07:CB:A9:A4:80:73:31
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A95F23B52AF10895886FB65323D29A9876EA7D396F805E4CA280D561C26E3DAD
    SPKI SHA256: E4F2788C1D6C8C9E64C776B40ECDA7A093DCD3B64E6FFCB5BD1D6D375B7916C4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_certificate_policies_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### CFCA DV ECC CA

- Subject: countryName=CN, organizationName=China Financial Certification Authority, commonName=CFCA DV ECC CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 2756495F96F59F3DCFDD2ED5B72DA76B
- SHA-256: 690DD5AB690009813339BC668C6D3839144F34E17E5BE7F0958879E9A9E057FB
- SPKI SHA-256: 402ACD8725E25934BECD328C85C34662E685DD287EA82CB71EBEFB67243E5D30
- Validity: 2023-12-05 to 2027-05-23
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://cfcadveccca.crl.certum.pl/cfcadveccca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            27:56:49:5f:96:f5:9f:3d:cf:dd:2e:d5:b7:2d:a7:6b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Dec  5 08:47:28 2023 GMT
            Not After : May 23 08:47:28 2027 GMT
        Subject: C = CN, O = China Financial Certification Authority, CN = CFCA DV ECC CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C9:F7:4A:FE:5E:E4:13:4B:0D:A4:91:9E:DC:5B:50:C7:5A:53:76:12
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 690DD5AB690009813339BC668C6D3839144F34E17E5BE7F0958879E9A9E057FB
    SPKI SHA256: 402ACD8725E25934BECD328C85C34662E685DD287EA82CB71EBEFB67243E5D30
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### CFCA DV RSA CA

- Subject: countryName=CN, organizationName=China Financial Certification Authority, commonName=CFCA DV RSA CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: BA750BADFB4AFBC520107CE31AF7AB58
- SHA-256: ED124F475AAF4D98D1E618D3BE32F003B3CBB873C7D15B0F1A0089739CB4E4CC
- SPKI SHA-256: A3CF86E207B80CFE9112A3FC9EA12020AA54D4C6017D24E8D975E80089418550
- Validity: 2023-12-05 to 2027-05-23
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://cfcadvrsaca.crl.certum.pl/cfcadvrsaca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ba:75:0b:ad:fb:4a:fb:c5:20:10:7c:e3:1a:f7:ab:58
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Dec  5 08:41:56 2023 GMT
            Not After : May 23 08:41:56 2027 GMT
        Subject: C = CN, O = China Financial Certification Authority, CN = CFCA DV RSA CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                77:88:AD:93:09:E1:0F:72:DF:C2:65:86:86:84:59:E9:F9:86:D1:6F
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: ED124F475AAF4D98D1E618D3BE32F003B3CBB873C7D15B0F1A0089739CB4E4CC
    SPKI SHA256: A3CF86E207B80CFE9112A3FC9EA12020AA54D4C6017D24E8D975E80089418550
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### CFCA EV ECC CA

- Subject: countryName=CN, organizationName=China Financial Certification Authority, commonName=CFCA EV ECC CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: CC081BF16779E9CBEFE2E0190EF51EE6
- SHA-256: D65810FFD7BF9A0E5779DF6753BA3894379F850B1B743AEC55786F98AC29011F
- SPKI SHA-256: 4FF27B4F65E9D2D5D4C729BB916AA3F77F308B38B8209292BA4D82C7F7A2F9AD
- Validity: 2023-12-05 to 2027-05-23
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://cfcaeveccca.crl.certum.pl/cfcaeveccca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            cc:08:1b:f1:67:79:e9:cb:ef:e2:e0:19:0e:f5:1e:e6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Dec  5 08:48:31 2023 GMT
            Not After : May 23 08:48:31 2027 GMT
        Subject: C = CN, O = China Financial Certification Authority, CN = CFCA EV ECC CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                21:39:33:BE:14:F3:D0:F6:CF:A8:56:07:73:10:EA:5C:75:ED:49:37
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D65810FFD7BF9A0E5779DF6753BA3894379F850B1B743AEC55786F98AC29011F
    SPKI SHA256: 4FF27B4F65E9D2D5D4C729BB916AA3F77F308B38B8209292BA4D82C7F7A2F9AD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### CFCA EV RSA CA

- Subject: countryName=CN, organizationName=China Financial Certification Authority, commonName=CFCA EV RSA CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: B3F601DB6BAAE814497D3FB59E1216E5
- SHA-256: 98380E437E1A46E6AC2AA64D7BE6D71F2969E510ACAF5D37846CF12B8AFE7B3E
- SPKI SHA-256: 168B2D8D20CB122184620AACFD7E60926233ADD2D564E57BCAF68A5A6B7DE3BB
- Validity: 2023-12-05 to 2027-05-23
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://cfcaevrsaca.crl.certum.pl/cfcaevrsaca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b3:f6:01:db:6b:aa:e8:14:49:7d:3f:b5:9e:12:16:e5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Dec  5 08:44:28 2023 GMT
            Not After : May 23 08:44:28 2027 GMT
        Subject: C = CN, O = China Financial Certification Authority, CN = CFCA EV RSA CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                BB:BA:BE:00:F4:D0:AB:06:E6:0F:B8:7B:F0:B4:18:0F:A3:D5:15:E8
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 98380E437E1A46E6AC2AA64D7BE6D71F2969E510ACAF5D37846CF12B8AFE7B3E
    SPKI SHA256: 168B2D8D20CB122184620AACFD7E60926233ADD2D564E57BCAF68A5A6B7DE3BB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### CFCA OV ECC CA

- Subject: countryName=CN, organizationName=China Financial Certification Authority, commonName=CFCA OV ECC CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: FA1CB08C7144FBD63A0A033CEAED4634
- SHA-256: A92BF1FDFB2DA2A1CE60E7440992E53A410CE2FAA8AB71EAD7444F2486E5FA9F
- SPKI SHA-256: 4CDFCDE897F9AC86ED2BCCEB4773BF9788D1687FEE3435B6BB2EC1A4BEB04692
- Validity: 2023-12-05 to 2027-05-23
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://cfcaoveccca.crl.certum.pl/cfcaoveccca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            fa:1c:b0:8c:71:44:fb:d6:3a:0a:03:3c:ea:ed:46:34
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Dec  5 08:46:01 2023 GMT
            Not After : May 23 08:46:01 2027 GMT
        Subject: C = CN, O = China Financial Certification Authority, CN = CFCA OV ECC CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                63:EF:04:30:A4:74:6E:E1:44:E1:EC:3E:38:F1:21:1F:7F:42:11:71
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A92BF1FDFB2DA2A1CE60E7440992E53A410CE2FAA8AB71EAD7444F2486E5FA9F
    SPKI SHA256: 4CDFCDE897F9AC86ED2BCCEB4773BF9788D1687FEE3435B6BB2EC1A4BEB04692
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### CFCA OV RSA CA

- Subject: countryName=CN, organizationName=China Financial Certification Authority, commonName=CFCA OV RSA CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: D74380618371EA603EB432409C2B8DDA
- SHA-256: 076EA7358389410DF85D911D251B9A582C5E6F684E0F046ED430187F0533AEFC
- SPKI SHA-256: A031F9E8070B631B4744BD15CECFBA34E6C25F2156682A8A7F5F5522B05754A6
- Validity: 2023-12-05 to 2027-05-23
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://cfcaovrsaca.crl.certum.pl/cfcaovrsaca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d7:43:80:61:83:71:ea:60:3e:b4:32:40:9c:2b:8d:da
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Dec  5 08:42:54 2023 GMT
            Not After : May 23 08:42:54 2027 GMT
        Subject: C = CN, O = China Financial Certification Authority, CN = CFCA OV RSA CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                32:FC:68:60:90:25:17:C7:9B:79:FC:C9:42:77:07:10:DD:24:0E:52
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 076EA7358389410DF85D911D251B9A582C5E6F684E0F046ED430187F0533AEFC
    SPKI SHA256: A031F9E8070B631B4744BD15CECFBA34E6C25F2156682A8A7F5F5522B05754A6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### CNSSL DV TLS G2 R36 CA

- Subject: countryName=CN, organizationName=Henan Fierce Fire Network Technology Co., Ltd., commonName=CNSSL DV TLS G2 R36 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 81BAE1C2D034BE1C86805AB7618BE1CA
- SHA-256: C69DB01A92010CC036EEBC5B31268F0BEBD9B66F49105F1AD96F8FA6530F31B0
- SPKI SHA-256: 1BEEC95CD7BF49CE02E45FD4B673EC80354CE29F294C320DC613F8460F13B865
- Validity: 2026-01-14 to 2036-01-02
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://cnssldvtlsg2r36ca.crl.certum.pl/cnssldvtlsg2r36ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:ba:e1:c2:d0:34:be:1c:86:80:5a:b7:61:8b:e1:ca
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Jan 14 08:57:47 2026 GMT
            Not After : Jan  2 08:57:47 2036 GMT
        Subject: C = CN, O = "Henan Fierce Fire Network Technology Co., Ltd.", CN = CNSSL DV TLS G2 R36 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F1:EF:B1:79:41:09:F1:E9:15:8B:E9:AB:2C:96:82:96:BA:51:EB:A5
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: C69DB01A92010CC036EEBC5B31268F0BEBD9B66F49105F1AD96F8FA6530F31B0
    SPKI SHA256: 1BEEC95CD7BF49CE02E45FD4B673EC80354CE29F294C320DC613F8460F13B865
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CNSSL OV TLS G2 R36 CA

- Subject: countryName=CN, organizationName=Henan Fierce Fire Network Technology Co., Ltd., commonName=CNSSL OV TLS G2 R36 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 7234CD04691E50BCF75DA36396EDF6D9
- SHA-256: 27DE66F355250789599D18137C54A1919A59A7737F1634CE935DD3CA898C5101
- SPKI SHA-256: 89F221858E18A98D98E3B694D3D78BEFC48E43C5B78CF99E8AD08327375D6B6C
- Validity: 2026-02-11 to 2036-01-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://cnsslovtlsg2r36ca.crl.certum.pl/cnsslovtlsg2r36ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            72:34:cd:04:69:1e:50:bc:f7:5d:a3:63:96:ed:f6:d9
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Feb 11 09:12:12 2026 GMT
            Not After : Jan 30 09:12:12 2036 GMT
        Subject: C = CN, O = "Henan Fierce Fire Network Technology Co., Ltd.", CN = CNSSL OV TLS G2 R36 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                D2:43:BB:8C:4F:13:C0:0A:BE:DD:C1:7C:C0:6A:DC:47:72:F9:FD:63
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 27DE66F355250789599D18137C54A1919A59A7737F1634CE935DD3CA898C5101
    SPKI SHA256: 89F221858E18A98D98E3B694D3D78BEFC48E43C5B78CF99E8AD08327375D6B6C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### cyber_Folks

- Subject: countryName=PL, organizationName=cyber_Folks S.A., commonName=cyber_Folks
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: D32C4556DD4ACFE0284D1368DC837582
- SHA-256: 2E198C227F93F9CF96F7B8A1986F659735502C956407DB36F0D4A3D601F42472
- SPKI SHA-256: B2184A304D0AC6A650DB01EAC60C53A0C1E610A8729D7A3F5B4542C350C81D15
- Validity: 2023-03-16 to 2027-05-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://crl.certum.pl/cyberfolks.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d3:2c:45:56:dd:4a:cf:e0:28:4d:13:68:dc:83:75:82
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Mar 16 09:25:52 2023 GMT
            Not After : May 20 09:25:52 2027 GMT
        Subject: C = PL, O = cyber_Folks S.A., CN = cyber_Folks
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                83:F0:DA:D0:5C:24:15:7E:B0:F3:59:57:22:54:65:C5:FA:13:42:F8
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2E198C227F93F9CF96F7B8A1986F659735502C956407DB36F0D4A3D601F42472
    SPKI SHA256: B2184A304D0AC6A650DB01EAC60C53A0C1E610A8729D7A3F5B4542C350C81D15
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### cyber_Folks

- Subject: countryName=PL, organizationName=cyber_Folks S.A., commonName=cyber_Folks
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 8C353DD1E4236E8D51A3AD574E262090
- SHA-256: 35F8CC89610508BC16BD332DA543964698C72D67895FEB4E068BEA5E06686457
- SPKI SHA-256: 92AE7E5AFEA9FD0935759E3E0AAE12708B0B7EFB7746B041138D32DD6C27B648
- Validity: 2023-05-15 to 2027-05-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://cyberfolks2.crl.certum.pl/cyberfolks2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            8c:35:3d:d1:e4:23:6e:8d:51:a3:ad:57:4e:26:20:90
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: May 15 07:59:19 2023 GMT
            Not After : May 20 07:59:19 2027 GMT
        Subject: C = PL, O = cyber_Folks S.A., CN = cyber_Folks
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                05:DD:B1:C4:44:3B:E1:A2:82:53:72:E2:76:5D:A9:14:F9:24:AD:45
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 35F8CC89610508BC16BD332DA543964698C72D67895FEB4E068BEA5E06686457
    SPKI SHA256: 92AE7E5AFEA9FD0935759E3E0AAE12708B0B7EFB7746B041138D32DD6C27B648
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GDCA TrustAUTH R4 DV SSL CA G2

- Subject: countryName=CN, organizationName=Global Digital Cybersecurity Authority Co., Ltd., commonName=GDCA TrustAUTH R4 DV SSL CA G2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 9E9CB69426C45CC4306D3E1CC2A79EFC
- SHA-256: 6CDF9DCBF3510A3BB402761D62D0C5E4E7AFC51D9CFF01F02BD53256DC567ADF
- SPKI SHA-256: 71FB108FAF19908C9B935817EA18B359A72813B86FA8936E8CDBB6134DE7FF78
- Validity: 2018-01-26 to 2027-05-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://gdcadv.crl.certum.pl/gdcadv.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            9e:9c:b6:94:26:c4:5c:c4:30:6d:3e:1c:c2:a7:9e:fc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jan 26 09:21:29 2018 GMT
            Not After : May 20 09:21:29 2027 GMT
        Subject: C = CN, O = "Global Digital Cybersecurity Authority Co., Ltd.", CN = GDCA TrustAUTH R4 DV SSL CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                22:4B:93:E5:3B:46:AF:A9:01:EB:03:DB:CA:9A:83:B8:5C:AF:0D:F1
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6CDF9DCBF3510A3BB402761D62D0C5E4E7AFC51D9CFF01F02BD53256DC567ADF
    SPKI SHA256: 71FB108FAF19908C9B935817EA18B359A72813B86FA8936E8CDBB6134DE7FF78
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GDCA TrustAUTH R4 EV SSL CA G2

- Subject: countryName=CN, organizationName=Global Digital Cybersecurity Authority Co., Ltd., commonName=GDCA TrustAUTH R4 EV SSL CA G2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: D5F83E8DDAF67C8829E89016B7877D13
- SHA-256: 6869242CD8AD2AC77BC028947BC7D0C4F6E9CBF0899D65709810D89F94B5D70D
- SPKI SHA-256: 1A57EB460C3D8D6F55342ED8D5A5C3B13B0787A7543C012E77C7E1CCE3BE11D6
- Validity: 2018-01-26 to 2027-05-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://gdcaev.crl.certum.pl/gdcaev.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d5:f8:3e:8d:da:f6:7c:88:29:e8:90:16:b7:87:7d:13
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jan 26 09:21:58 2018 GMT
            Not After : May 20 09:21:58 2027 GMT
        Subject: C = CN, O = "Global Digital Cybersecurity Authority Co., Ltd.", CN = GDCA TrustAUTH R4 EV SSL CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B3:63:11:8C:BA:25:37:AC:38:A0:DC:37:44:EB:6D:0E:3D:3C:C8:8B
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6869242CD8AD2AC77BC028947BC7D0C4F6E9CBF0899D65709810D89F94B5D70D
    SPKI SHA256: 1A57EB460C3D8D6F55342ED8D5A5C3B13B0787A7543C012E77C7E1CCE3BE11D6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GDCA TrustAUTH R4 OV SSL CA G2

- Subject: countryName=CN, organizationName=Global Digital Cybersecurity Authority Co., Ltd., commonName=GDCA TrustAUTH R4 OV SSL CA G2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: B0EFD02A81BF1CE89F7A18C294E4C33C
- SHA-256: E81B01F9F5692CF3823C6FD35886542BFAEEFC5EA94F4E246E42C4A9FC5FE8AB
- SPKI SHA-256: 5FF9034491B2A3582BE57812E211A4035247D7D45B9F4FA301DC51906C0E7E2B
- Validity: 2018-01-26 to 2027-05-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://gdcaov.crl.certum.pl/gdcaov.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b0:ef:d0:2a:81:bf:1c:e8:9f:7a:18:c2:94:e4:c3:3c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jan 26 09:20:14 2018 GMT
            Not After : May 20 09:20:14 2027 GMT
        Subject: C = CN, O = "Global Digital Cybersecurity Authority Co., Ltd.", CN = GDCA TrustAUTH R4 OV SSL CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                87:FE:70:A9:2C:45:35:FF:E1:0A:36:1D:D2:65:CA:4D:F5:9D:E7:85
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E81B01F9F5692CF3823C6FD35886542BFAEEFC5EA94F4E246E42C4A9FC5FE8AB
    SPKI SHA256: 5FF9034491B2A3582BE57812E211A4035247D7D45B9F4FA301DC51906C0E7E2B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GeoSSL DV TLS CA

- Subject: countryName=CN, organizationName=GeoSSL, Inc., commonName=GeoSSL DV TLS CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 5194CE6712E63F95F7B4AADF9396BEB7
- SHA-256: B5C8E05AA6826A4E43ACC5CEBC652AD7A5D5FA158DC1C9211DD5C50184BD7A97
- SPKI SHA-256: CA59CE3662C6A11FCB1B3CD5EE490C5FED8603B11B9F2C9DF784A10071F715B1
- Validity: 2024-12-17 to 2034-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://geossldvtlsr34g2ca.crl.certum.pl/geossldvtlsr34g2ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            51:94:ce:67:12:e6:3f:95:f7:b4:aa:df:93:96:be:b7
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Dec 17 10:01:11 2024 GMT
            Not After : Dec  5 10:01:11 2034 GMT
        Subject: C = CN, O = "GeoSSL, Inc.", CN = GeoSSL DV TLS CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E7:02:D9:7A:9E:C4:19:03:71:AA:27:B7:B8:77:0F:93:A1:55:1B:C0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: B5C8E05AA6826A4E43ACC5CEBC652AD7A5D5FA158DC1C9211DD5C50184BD7A97
    SPKI SHA256: CA59CE3662C6A11FCB1B3CD5EE490C5FED8603B11B9F2C9DF784A10071F715B1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GeoSSL EV TLS CA

- Subject: countryName=CN, organizationName=GeoSSL, Inc., commonName=GeoSSL EV TLS CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: E344E1A780B842A76925879F14315710
- SHA-256: 9E9A40D4DED044B0E40E8FD2D76C19E46FC5FC7F90BCAEBCFBC050AAF862CE75
- SPKI SHA-256: 198EF5A150AB622A89888D9770EA4DB11AF2DA013444EB0D153CA73E3F7CF1EC
- Validity: 2024-12-17 to 2034-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://geosslevtlsr34g2ca.crl.certum.pl/geosslevtlsr34g2ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            e3:44:e1:a7:80:b8:42:a7:69:25:87:9f:14:31:57:10
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Dec 17 10:02:53 2024 GMT
            Not After : Dec  5 10:02:53 2034 GMT
        Subject: C = CN, O = "GeoSSL, Inc.", CN = GeoSSL EV TLS CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                71:FE:B0:44:FA:D7:4F:5E:E5:4A:FA:06:B2:7E:AE:30:B9:2A:12:94
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 9E9A40D4DED044B0E40E8FD2D76C19E46FC5FC7F90BCAEBCFBC050AAF862CE75
    SPKI SHA256: 198EF5A150AB622A89888D9770EA4DB11AF2DA013444EB0D153CA73E3F7CF1EC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GeoSSL OV TLS CA

- Subject: countryName=CN, organizationName=GeoSSL, Inc., commonName=GeoSSL OV TLS CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: A1383FEBD1520265754E5204DE48520B
- SHA-256: 45C479E096C7C8BB2CB90E9D3BD6FDE3CA3240308E67D00DD64DF5BA06978800
- SPKI SHA-256: 35813236B0EA672E0A7B9B4EE3750FA0ED934F67CF3B4F5B5C7437A92AC0603F
- Validity: 2024-12-17 to 2034-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://geosslovtlsr34g2ca.crl.certum.pl/geosslovtlsr34g2ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            a1:38:3f:eb:d1:52:02:65:75:4e:52:04:de:48:52:0b
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Dec 17 10:02:02 2024 GMT
            Not After : Dec  5 10:02:02 2034 GMT
        Subject: C = CN, O = "GeoSSL, Inc.", CN = GeoSSL OV TLS CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                1C:3A:70:BD:1F:CE:C7:10:1E:9B:ED:B8:6D:49:ED:E6:8A:FB:55:88
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 45C479E096C7C8BB2CB90E9D3BD6FDE3CA3240308E67D00DD64DF5BA06978800
    SPKI SHA256: 35813236B0EA672E0A7B9B4EE3750FA0ED934F67CF3B4F5B5C7437A92AC0603F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### GIS CA

- Subject: countryName=RU, organizationName=GAZINFORMSERVICE Company limited, organizationalUnitName=CA, commonName=GIS CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA
- Serial: 3C3FD833A19FE6DFF722638B81CDAF1D
- SHA-256: 7CFA94F9E59A3E447C5FC719CC4349EE81EF001B35CD3D1AF4AE9512F5A1B7F9
- SPKI SHA-256: BCA9053C9A0AF81AEDE27A5AA21C808F1890F202EF09072B47A52E22EA5092BE
- Validity: 2012-06-14 to 2022-06-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/gisca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/gsca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3c:3f:d8:33:a1:9f:e6:df:f7:22:63:8b:81:cd:af:1d
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA
        Validity
            Not Before: Jun 14 12:22:51 2012 GMT
            Not After : Jun 12 12:22:51 2022 GMT
        Subject: C = RU, O = GAZINFORMSERVICE Company limited, OU = CA, CN = GIS CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A8:2C:00:DA:85:41:8D:5F:61:C0:FE:44:D5:10:F6:A5:FD:60:06:00
            X509v3 Authority Key Identifier:
                45:C5:B2:86:4E:CC:DD:29:97:E4:DD:14:C4:6E:AE:4D:B8:C1:77:F8
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/gsca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gsca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 7CFA94F9E59A3E447C5FC719CC4349EE81EF001B35CD3D1AF4AE9512F5A1B7F9
    SPKI SHA256: BCA9053C9A0AF81AEDE27A5AA21C808F1890F202EF09072B47A52E22EA5092BE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gsca.cer
- CRL Distribution Points: http://crl.certum.pl/gsca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_wrong_time_format_pre2050: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GIS CA

- Subject: countryName=RU, organizationName=GAZINFORMSERVICE Company limited, organizationalUnitName=CA, commonName=GIS CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA
- Serial: 1E4493CE9332489353EBE3E5DCCA4595
- SHA-256: 982F71BA61EFFF00356D2C623701E57482D7DA554919559F2EA2A09AF0C19FD9
- SPKI SHA-256: BCA9053C9A0AF81AEDE27A5AA21C808F1890F202EF09072B47A52E22EA5092BE
- Validity: 2012-06-14 to 2022-06-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.certum.pl/gsca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1e:44:93:ce:93:32:48:93:53:eb:e3:e5:dc:ca:45:95
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA
        Validity
            Not Before: Jun 14 12:22:51 2012 GMT
            Not After : Jun 12 12:22:51 2022 GMT
        Subject: C = RU, O = GAZINFORMSERVICE Company limited, OU = CA, CN = GIS CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/gsca.crl
            Authority Information Access:
                CA Issuers - URI:http://repository.certum.pl/gsca.cer
            X509v3 Authority Key Identifier:
                45:C5:B2:86:4E:CC:DD:29:97:E4:DD:14:C4:6E:AE:4D:B8:C1:77:F8
            X509v3 Subject Key Identifier:
                A8:2C:00:DA:85:41:8D:5F:61:C0:FE:44:D5:10:F6:A5:FD:60:06:00
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 982F71BA61EFFF00356D2C623701E57482D7DA554919559F2EA2A09AF0C19FD9
    SPKI SHA256: BCA9053C9A0AF81AEDE27A5AA21C808F1890F202EF09072B47A52E22EA5092BE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://repository.certum.pl/gsca.cer
- CRL Distribution Points: http://crl.certum.pl/gsca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### GIS CA

- Subject: countryName=RU, organizationName=GAZINFORMSERVICE Company limited, organizationalUnitName=CA, commonName=GIS CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 3D77A35B76B02931BC300D969F6161B6
- SHA-256: 2E816BCF852D830245DDC3534BCF85A53B0B19991A525CD328626FD74A40FC82
- SPKI SHA-256: 066CA18FAD76FB0A287064691E7735F6BDDDC4BF12CF7A86E0B0C8AFA541DE16
- Validity: 2014-09-30 to 2024-09-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/giscasha2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3d:77:a3:5b:76:b0:29:31:bc:30:0d:96:9f:61:61:b6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Sep 30 11:51:53 2014 GMT
            Not After : Sep 27 11:51:53 2024 GMT
        Subject: C = RU, O = GAZINFORMSERVICE Company limited, OU = CA, CN = GIS CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Subject Key Identifier:
                BD:44:93:CF:24:B3:E5:CE:C7:FC:02:F7:E8:5A:81:B4:59:32:99:CA
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2E816BCF852D830245DDC3534BCF85A53B0B19991A525CD328626FD74A40FC82
    SPKI SHA256: 066CA18FAD76FB0A287064691E7735F6BDDDC4BF12CF7A86E0B0C8AFA541DE16
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_certificate_policies_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### GIS CA

- Subject: countryName=RU, organizationName=GAZINFORMSERVICE Company limited, organizationalUnitName=CA, commonName=GIS CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA
- Serial: 7963D08750DF7E1C8D51E60397C615B4
- SHA-256: 9CE3B21A9934F88506430F52C35E3E01FEF32CCEE7847E52783BFCDB42AB7D2F
- SPKI SHA-256: BCA9053C9A0AF81AEDE27A5AA21C808F1890F202EF09072B47A52E22EA5092BE
- Validity: 2011-10-10 to 2021-10-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.certum.pl/gsca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:63:d0:87:50:df:7e:1c:8d:51:e6:03:97:c6:15:b4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA
        Validity
            Not Before: Oct 10 11:03:16 2011 GMT
            Not After : Oct  7 11:03:16 2021 GMT
        Subject: C = RU, O = GAZINFORMSERVICE Company limited, OU = CA, CN = GIS CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/gsca.crl
            X509v3 Authority Key Identifier:
                45:C5:B2:86:4E:CC:DD:29:97:E4:DD:14:C4:6E:AE:4D:B8:C1:77:F8
            X509v3 Subject Key Identifier:
                A8:2C:00:DA:85:41:8D:5F:61:C0:FE:44:D5:10:F6:A5:FD:60:06:00
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9CE3B21A9934F88506430F52C35E3E01FEF32CCEE7847E52783BFCDB42AB7D2F
    SPKI SHA256: BCA9053C9A0AF81AEDE27A5AA21C808F1890F202EF09072B47A52E22EA5092BE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.certum.pl/gsca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### GoGetSSL Business Validation CA SHA2

- Subject: countryName=LV, organizationName=EnVers Group SIA, organizationalUnitName=GoGetSSL Certification Authority, commonName=GoGetSSL Business Validation CA SHA2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: C557EAC31E7E21FB026F20E096B6BAD4
- SHA-256: 18958D03AFB409687A1BC263860D0D735A25A004AB60E0F0E45D6333587437AE
- SPKI SHA-256: 5A125BD51863EBE5177ED55491E555E4288E6707D617881DB24115BF25A93713
- Validity: 2018-01-26 to 2027-05-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://gogetsslov.crl.certum.pl/gogetsslov.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c5:57:ea:c3:1e:7e:21:fb:02:6f:20:e0:96:b6:ba:d4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jan 26 09:15:10 2018 GMT
            Not After : May 20 09:15:10 2027 GMT
        Subject: C = LV, O = EnVers Group SIA, OU = GoGetSSL Certification Authority, CN = GoGetSSL Business Validation CA SHA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                38:2D:B9:E1:27:27:01:2A:98:2A:0A:F0:CC:F9:36:CC:30:4B:B0:8F
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 18958D03AFB409687A1BC263860D0D735A25A004AB60E0F0E45D6333587437AE
    SPKI SHA256: 5A125BD51863EBE5177ED55491E555E4288E6707D617881DB24115BF25A93713
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GoGetSSL Domain Validation CA SHA2

- Subject: countryName=LV, organizationName=EnVers Group SIA, organizationalUnitName=GoGetSSL Certification Authority, commonName=GoGetSSL Domain Validation CA SHA2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: B0A20C009DA4B5EBA644C79C228270C5
- SHA-256: B5F62EC38131CD14B1FC95B877F4D210BE4BFACC7E6A6AA1422D89E34B7AC4C1
- SPKI SHA-256: A75F396D8C6214EF99C0A015FA6227787C3EBEE1F6AEAA589033B28CA37B0F21
- Validity: 2018-01-26 to 2027-05-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://gogetssldv.crl.certum.pl/gogetssldv.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b0:a2:0c:00:9d:a4:b5:eb:a6:44:c7:9c:22:82:70:c5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jan 26 09:05:16 2018 GMT
            Not After : May 20 09:05:16 2027 GMT
        Subject: C = LV, O = EnVers Group SIA, OU = GoGetSSL Certification Authority, CN = GoGetSSL Domain Validation CA SHA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                78:5D:91:5C:B7:A7:1B:47:80:E6:E7:9C:42:A8:94:DD:59:DF:4E:A4
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B5F62EC38131CD14B1FC95B877F4D210BE4BFACC7E6A6AA1422D89E34B7AC4C1
    SPKI SHA256: A75F396D8C6214EF99C0A015FA6227787C3EBEE1F6AEAA589033B28CA37B0F21
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### GoGetSSL Extended Validation CA SHA2

- Subject: countryName=LV, organizationName=EnVers Group SIA, organizationalUnitName=GoGetSSL Certification Authority, commonName=GoGetSSL Extended Validation CA SHA2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 27C6C981D3D15D0F78377121F8233E00
- SHA-256: EEDA15BA000B006EAD49A21BBE769F3BA6CE75C9249F0114D8DD882DFC0F2C1B
- SPKI SHA-256: 04F102C7AC0DABDD29F20BB462927515CD03C7B8744A692D7832B9C439974F96
- Validity: 2018-01-26 to 2027-05-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://gogetsslev.crl.certum.pl/gogetsslev.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            27:c6:c9:81:d3:d1:5d:0f:78:37:71:21:f8:23:3e:00
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jan 26 09:09:45 2018 GMT
            Not After : May 20 09:09:45 2027 GMT
        Subject: C = LV, O = EnVers Group SIA, OU = GoGetSSL Certification Authority, CN = GoGetSSL Extended Validation CA SHA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0C:6A:A5:A9:BD:6D:E7:38:15:D2:9F:72:38:AD:6C:76:29:80:45:95
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EEDA15BA000B006EAD49A21BBE769F3BA6CE75C9249F0114D8DD882DFC0F2C1B
    SPKI SHA256: 04F102C7AC0DABDD29F20BB462927515CD03C7B8744A692D7832B9C439974F96
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### home pl DV TLS G2 R35 CA

- Subject: countryName=PL, organizationName=home.pl S.A., commonName=home pl DV TLS G2 R35 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: AB0D6ABC69629407D2629660CB81DB3E
- SHA-256: CA1A6E0BC3B1C2ED099D42D7030577578D13F63B4B9680A6BAA274DF17C9DE58
- SPKI SHA-256: C1A76CC24952C37B676F70E950B534EF8FBFF85B4A1D4142674C5DF60257162D
- Validity: 2025-05-28 to 2035-05-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://homepldvtlsg2r35ca.crl.certum.pl/homepldvtlsg2r35ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ab:0d:6a:bc:69:62:94:07:d2:62:96:60:cb:81:db:3e
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: May 28 07:45:35 2025 GMT
            Not After : May 16 07:45:35 2035 GMT
        Subject: C = PL, O = home.pl S.A., CN = home pl DV TLS G2 R35 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                CE:4B:2D:89:DE:1F:D4:79:BD:EE:4D:37:C2:4A:A0:AF:A1:47:38:5A
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: CA1A6E0BC3B1C2ED099D42D7030577578D13F63B4B9680A6BAA274DF17C9DE58
    SPKI SHA256: C1A76CC24952C37B676F70E950B534EF8FBFF85B4A1D4142674C5DF60257162D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### home pl DV TLS G2 R36 CA

- Subject: countryName=PL, organizationName=home.pl sp. z o.o., commonName=home pl DV TLS G2 R36 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 0F453DCD31A9FE1F6564096CE96F05BA
- SHA-256: EC118EB8BD1B8ECCF0F8CAAEC1BDB9CD7AD495F756B94A58D09BEC62510EB679
- SPKI SHA-256: 355CBDEE8242BB7163AC1D1E7F9153058E0BA032BA975411DCC6DC9680B6D9BE
- Validity: 2026-01-14 to 2036-01-02
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://homepldvtlsg2r36ca.crl.certum.pl/homepldvtlsg2r36ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0f:45:3d:cd:31:a9:fe:1f:65:64:09:6c:e9:6f:05:ba
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Jan 14 08:54:47 2026 GMT
            Not After : Jan  2 08:54:47 2036 GMT
        Subject: C = PL, O = home.pl sp. z o.o., CN = home pl DV TLS G2 R36 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F6:A6:45:7A:60:F6:E8:15:40:B9:20:B5:D2:A6:B1:85:1E:ED:3B:DC
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: EC118EB8BD1B8ECCF0F8CAAEC1BDB9CD7AD495F756B94A58D09BEC62510EB679
    SPKI SHA256: 355CBDEE8242BB7163AC1D1E7F9153058E0BA032BA975411DCC6DC9680B6D9BE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### home pl OV TLS G2 R35 CA

- Subject: countryName=PL, organizationName=home.pl S.A., commonName=home pl OV TLS G2 R35 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 11E58A7E407F3AB00B3EDBC5100212FB
- SHA-256: 418B97140C71058A09E933B089D0D5683E3133CD5F72548F6C15A17579BA27DB
- SPKI SHA-256: 16F2053DE2C9978368A99DED6BDE18662A0244C8586E56F7EECAFC76A967BF6F
- Validity: 2025-05-28 to 2035-05-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://homeplovtlsg2r35ca.crl.certum.pl/homeplovtlsg2r35ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:e5:8a:7e:40:7f:3a:b0:0b:3e:db:c5:10:02:12:fb
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: May 28 07:47:25 2025 GMT
            Not After : May 16 07:47:25 2035 GMT
        Subject: C = PL, O = home.pl S.A., CN = home pl OV TLS G2 R35 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                E8:79:14:3F:6F:0A:ED:F7:5B:6F:3A:FB:F7:B4:67:E6:68:D7:13:EE
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 418B97140C71058A09E933B089D0D5683E3133CD5F72548F6C15A17579BA27DB
    SPKI SHA256: 16F2053DE2C9978368A99DED6BDE18662A0244C8586E56F7EECAFC76A967BF6F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### home pl OV TLS G2 R36 CA

- Subject: countryName=PL, organizationName=home.pl sp. z o.o., commonName=home pl OV TLS G2 R36 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: EC9896B837F6ED99A23AFA7932D7E005
- SHA-256: 53D56B6022FBFBC72CD9AC6706165D8AA1621FD98E047C4A8F62A58DAD2B2C72
- SPKI SHA-256: 7EA0821EA3A69B906176F4F418F678169FAB899EB32F7222C10D58F77658B882
- Validity: 2026-01-14 to 2036-01-02
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://homeplovtlsg2r36ca.crl.certum.pl/homeplovtlsg2r36ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ec:98:96:b8:37:f6:ed:99:a2:3a:fa:79:32:d7:e0:05
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Jan 14 08:56:59 2026 GMT
            Not After : Jan  2 08:56:59 2036 GMT
        Subject: C = PL, O = home.pl sp. z o.o., CN = home pl OV TLS G2 R36 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F3:52:74:AD:DC:E5:91:B4:E9:85:E1:E4:B9:D1:54:66:53:D1:89:5D
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 53D56B6022FBFBC72CD9AC6706165D8AA1621FD98E047C4A8F62A58DAD2B2C72
    SPKI SHA256: 7EA0821EA3A69B906176F4F418F678169FAB899EB32F7222C10D58F77658B882
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### IKARUS mail.security

- Subject: countryName=AT, organizationName=IKARUS Security Software GmbH, commonName=IKARUS mail.security
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., commonName=Certum Global Services SMIME RSA CA
- Serial: 2D4FAFA5AF0BBCDF2C8DFC4AC4C043E3
- SHA-256: 8006BF194B9856EAC36A0A1A4B88EAEB54018F06F8CED90E7669D5F373D71D59
- SPKI SHA-256: 14E8DA59BD83175A4DB3B745193F77120A57D9985F6C9898BD727C235810DE87
- Validity: 2023-08-08 to 2028-08-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://ikarussmime2.crl.certum.pl/ikarussmime2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.5.1.2, 2.23.140.1.5.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/cgssmimersaca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2d:4f:af:a5:af:0b:bc:df:2c:8d:fc:4a:c4:c0:43:e3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., CN = Certum Global Services SMIME RSA CA
        Validity
            Not Before: Aug  8 07:07:30 2023 GMT
            Not After : Aug  1 07:07:30 2028 GMT
        Subject: C = AT, O = IKARUS Security Software GmbH, CN = IKARUS mail.security
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                7F:D9:38:B5:26:A3:4B:EF:AE:21:1E:7D:32:14:DA:0C:AE:ED:09:56
            X509v3 Authority Key Identifier:
                7F:9D:5C:72:FF:6C:3A:FF:28:27:DB:C1:29:16:72:4E:61:19:E9:08
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/cgssmimersaca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/cgssmimersaca.cer
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.1.2
                Policy: 2.23.140.1.5.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8006BF194B9856EAC36A0A1A4B88EAEB54018F06F8CED90E7669D5F373D71D59
    SPKI SHA256: 14E8DA59BD83175A4DB3B745193F77120A57D9985F6C9898BD727C235810DE87
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.5.1.2, 2.23.140.1.5.1.3
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/cgssmimersaca.cer
- CRL Distribution Points: http://crl.certum.pl/cgssmimersaca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### IKARUS mail.security

- Subject: countryName=AT, organizationName=IKARUS Security Software GmbH, commonName=IKARUS mail.security
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 83E06505E0B5D1ACDC0858527EF53177
- SHA-256: 002E6D642C2EE639B40FBED1020EE7BEEDF2E521F9B2BDE46C958D32E6353E9D
- SPKI SHA-256: 09085A9BC622620E2A703B271F8E8E2A19F15DB9A2BEBA2218A75586956A445C
- Validity: 2023-06-13 to 2027-05-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://ikarussmime.crl.certum.pl/ikarussmime.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:e0:65:05:e0:b5:d1:ac:dc:08:58:52:7e:f5:31:77
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jun 13 07:08:12 2023 GMT
            Not After : May 20 07:08:12 2027 GMT
        Subject: C = AT, O = IKARUS Security Software GmbH, CN = IKARUS mail.security
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                89:A3:99:FD:61:94:EA:EC:5F:21:CA:95:6B:28:27:3E:F5:C4:CB:06
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 002E6D642C2EE639B40FBED1020EE7BEEDF2E521F9B2BDE46C958D32E6353E9D
    SPKI SHA256: 09085A9BC622620E2A703B271F8E8E2A19F15DB9A2BEBA2218A75586956A445C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### IKARUS mail.security SMIME G1 R36 CA

- Subject: countryName=AT, organizationName=IKARUS Security GmbH, commonName=IKARUS mail.security SMIME G1 R36 CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA 2
- Serial: 6B352021C918DAEC5FAC4C8E98DDF22B
- SHA-256: 4CE86EC569454765D871D05E6D8C5B0B2102B4D02B0AA132F348A5F54A73D46B
- SPKI SHA-256: 45C95F569EACE552D9BB34073CBA0AAC72AA7A76502F958B68C99AE5151863AC
- Validity: 2026-05-06 to 2036-04-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://ikarusmailsecuritysmimeg1r36ca.crl.certum.pl/ikarusmailsecuritysmimeg1r36ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6b:35:20:21:c9:18:da:ec:5f:ac:4c:8e:98:dd:f2:2b
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA 2
        Validity
            Not Before: May  6 07:40:33 2026 GMT
            Not After : Apr 23 07:40:33 2036 GMT
        Subject: C = AT, O = IKARUS Security GmbH, CN = IKARUS mail.security SMIME G1 R36 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctnca2.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                B6:A1:54:39:02:C3:A0:3F:8E:8A:BC:FA:D4:F8:1C:A6:D1:3A:0E:FD
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca2.crl
            X509v3 Extended Key Usage:
                E-mail Protection, TLS Web Client Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                1C:2E:6C:92:39:9C:3F:DC:98:A5:DE:EF:0F:84:29:10:F9:64:C2:7B
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 4CE86EC569454765D871D05E6D8C5B0B2102B4D02B0AA132F348A5F54A73D46B
    SPKI SHA256: 45C95F569EACE552D9BB34073CBA0AAC72AA7A76502F958B68C99AE5151863AC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctnca2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### iTrust DV TLS CA

- Subject: countryName=CN, organizationName=iTrust, Inc, commonName=iTrust DV TLS CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 866441CCE9AE56EF2CB838C027FFEE6A
- SHA-256: 7CF26EB49E3999795959A80A7305EB7048D179CB15DD2DE897702EBA1F42C082
- SPKI SHA-256: 0B78F53558969C1D7D6531E4A6C168D40A4A537BC8AB88A2514707B7ADEA42E9
- Validity: 2025-01-15 to 2035-01-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://itrusdvtlsr35g2ca.crl.certum.pl/itrusdvtlsr35g2ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:64:41:cc:e9:ae:56:ef:2c:b8:38:c0:27:ff:ee:6a
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Jan 15 10:33:04 2025 GMT
            Not After : Jan  3 10:33:04 2035 GMT
        Subject: C = CN, O = "iTrust, Inc", CN = iTrust DV TLS CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                D7:5F:82:DA:84:1A:D7:FD:17:FB:FC:00:C0:D3:24:80:84:B4:3D:6F
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 7CF26EB49E3999795959A80A7305EB7048D179CB15DD2DE897702EBA1F42C082
    SPKI SHA256: 0B78F53558969C1D7D6531E4A6C168D40A4A537BC8AB88A2514707B7ADEA42E9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### iTrust OV TLS CA

- Subject: countryName=CN, organizationName=iTrust, Inc, commonName=iTrust OV TLS CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 1FC7068437F72BD3DD0EA2742F5FF4C5
- SHA-256: 553602422FD9B73B95DB5D78B24DC83EA58D046D93D4A9D87493AA706CE62F3D
- SPKI SHA-256: E287C1C1BC7A30360635A3A29C5A36AACF2BD8F635B8E16F905302CF114C09FA
- Validity: 2025-01-15 to 2035-01-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://itrusovtlsr35g2ca.crl.certum.pl/itrusovtlsr35g2ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1f:c7:06:84:37:f7:2b:d3:dd:0e:a2:74:2f:5f:f4:c5
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Jan 15 10:34:10 2025 GMT
            Not After : Jan  3 10:34:10 2035 GMT
        Subject: C = CN, O = "iTrust, Inc", CN = iTrust OV TLS CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                7A:75:55:01:6C:1B:21:8C:A2:91:C2:83:32:33:2F:E5:40:8C:B0:78
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 553602422FD9B73B95DB5D78B24DC83EA58D046D93D4A9D87493AA706CE62F3D
    SPKI SHA256: E287C1C1BC7A30360635A3A29C5A36AACF2BD8F635B8E16F905302CF114C09FA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### JoySSL DV TLS G2 R33 CA

- Subject: countryName=CN, organizationName=JoySSL Limited, commonName=JoySSL DV TLS G2 R33 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 345E1A056C9ECFC801A11573497DEE9A
- SHA-256: 43EDFB2C7C93E63D6566D240EB9C69CFF5C0D5C996C4AC9BCC9CE75828C3B9BE
- SPKI SHA-256: E876CC4BE9A3249EF8C0884925255F20AF7334A16E79710CF3AB3576D173E987
- Validity: 2024-08-20 to 2033-08-08
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://joyssldvtlsg2r33ca.crl.certum.pl/joyssldvtlsg2r33ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            34:5e:1a:05:6c:9e:cf:c8:01:a1:15:73:49:7d:ee:9a
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Aug 20 09:32:47 2024 GMT
            Not After : Aug  8 09:32:47 2033 GMT
        Subject: C = CN, O = JoySSL Limited, CN = JoySSL DV TLS G2 R33 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                BB:47:67:B9:8E:1C:23:56:6E:D9:C9:68:D6:AD:D4:2D:45:20:2E:ED
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 43EDFB2C7C93E63D6566D240EB9C69CFF5C0D5C996C4AC9BCC9CE75828C3B9BE
    SPKI SHA256: E876CC4BE9A3249EF8C0884925255F20AF7334A16E79710CF3AB3576D173E987
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### JoySSL OV TLS G2 R33 CA

- Subject: countryName=CN, organizationName=JoySSL Limited, commonName=JoySSL OV TLS G2 R33 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: DE05B81B5D2F6AD1ECC95BA3ED5F2B3D
- SHA-256: EF3653AC5056AA4C6EF72AA922F43DAF750CA901AD1198FEA1B81E0D10B51E0A
- SPKI SHA-256: D8109D2694C91172D2F3CD0C8D8F3E0C724DA5EFD6E35C5571B9B92C10382F8A
- Validity: 2024-08-20 to 2033-08-08
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://joysslovtlsg2r33ca.crl.certum.pl/joysslovtlsg2r33ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            de:05:b8:1b:5d:2f:6a:d1:ec:c9:5b:a3:ed:5f:2b:3d
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Aug 20 09:33:53 2024 GMT
            Not After : Aug  8 09:33:53 2033 GMT
        Subject: C = CN, O = JoySSL Limited, CN = JoySSL OV TLS G2 R33 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                0A:A1:74:F8:78:49:9E:55:56:0B:17:AD:60:16:B0:4B:23:2C:3F:1B
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: EF3653AC5056AA4C6EF72AA922F43DAF750CA901AD1198FEA1B81E0D10B51E0A
    SPKI SHA256: D8109D2694C91172D2F3CD0C8D8F3E0C724DA5EFD6E35C5571B9B92C10382F8A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### LH.pl CA

- Subject: countryName=PL, organizationName=LH.pl Sp. z o.o., commonName=LH.pl CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 833BCAD443EE6AD80D3853BAD3D2EDC4
- SHA-256: E4B2A0736F95950D11B82C9E6C32031E1420E06A66493E665F128AE499498FAB
- SPKI SHA-256: 309F8145AC38EE04B5BDE6CA59267F6387AD56B55292345D50DF4A3F83B1DCD3
- Validity: 2024-01-02 to 2027-05-11
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://lh2.crl.certum.pl/lh2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:3b:ca:d4:43:ee:6a:d8:0d:38:53:ba:d3:d2:ed:c4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jan  2 11:01:23 2024 GMT
            Not After : May 11 11:01:23 2027 GMT
        Subject: C = PL, O = LH.pl Sp. z o.o., CN = LH.pl CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DD:86:D4:07:61:90:52:09:C8:4D:01:1A:C3:83:5D:59:EA:CE:68:C2
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E4B2A0736F95950D11B82C9E6C32031E1420E06A66493E665F128AE499498FAB
    SPKI SHA256: 309F8145AC38EE04B5BDE6CA59267F6387AD56B55292345D50DF4A3F83B1DCD3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### nazwaSSL

- Subject: countryName=PL, organizationName=nazwa.pl S.A., organizationalUnitName=http://nazwa.pl, commonName=nazwaSSL
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA
- Serial: 1AD71FB5BB5A1D595D4975F4F3D42CD2
- SHA-256: E386DFBDACBF7EC1078C26456486D7B5159438928A3237BC1DCA7F975D2A514B
- SPKI SHA-256: 96FA8237FD5103BFFF53763624A338B3CF0413255336F4CB6FF91004E196E2B1
- Validity: 2014-05-06 to 2022-07-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/netartca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/gsca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1a:d7:1f:b5:bb:5a:1d:59:5d:49:75:f4:f3:d4:2c:d2
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA
        Validity
            Not Before: May  6 12:00:00 2014 GMT
            Not After : Jul  4 10:31:40 2022 GMT
        Subject: C = PL, O = nazwa.pl S.A., OU = http://nazwa.pl, CN = nazwaSSL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9D:CE:F0:5A:B4:CB:25:CF:36:A5:82:5D:8F:F7:7F:98:46:19:37:2E
            X509v3 Authority Key Identifier:
                45:C5:B2:86:4E:CC:DD:29:97:E4:DD:14:C4:6E:AE:4D:B8:C1:77:F8
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/gsca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gsca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E386DFBDACBF7EC1078C26456486D7B5159438928A3237BC1DCA7F975D2A514B
    SPKI SHA256: 96FA8237FD5103BFFF53763624A338B3CF0413255336F4CB6FF91004E196E2B1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gsca.cer
- CRL Distribution Points: http://crl.certum.pl/gsca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_wrong_time_format_pre2050: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### nazwaSSL

- Subject: countryName=PL, organizationName=nazwa.pl S.A., organizationalUnitName=http://nazwa.pl, commonName=nazwaSSL
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 528A14CDA91A4B45A5637C03647F42C1
- SHA-256: 749CC529CDAAB9AE2858147C4B001AE1D5BE058FC165C3E74AF9704131C5E1C1
- SPKI SHA-256: B0F86924C397D7F40422330DFE72F2F988A8C643B4A411922BB73E323F70C9BC
- Validity: 2014-09-30 to 2024-09-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/nazwasslsha2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:8a:14:cd:a9:1a:4b:45:a5:63:7c:03:64:7f:42:c1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Sep 30 11:54:18 2014 GMT
            Not After : Sep 27 11:54:18 2024 GMT
        Subject: C = PL, O = nazwa.pl S.A., OU = http://nazwa.pl, CN = nazwaSSL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Subject Key Identifier:
                B2:61:76:82:95:5A:01:37:17:97:C2:77:21:B5:ED:8B:FC:29:F7:67
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 749CC529CDAAB9AE2858147C4B001AE1D5BE058FC165C3E74AF9704131C5E1C1
    SPKI SHA256: B0F86924C397D7F40422330DFE72F2F988A8C643B4A411922BB73E323F70C9BC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_certificate_policies_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### nazwaSSL

- Subject: countryName=PL, organizationName=NetArt Spółka Akcyjna S.K.A., organizationalUnitName=http://nazwa.pl, commonName=nazwaSSL
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA
- Serial: 2E23DB35F439F7BFD158E04D575317A0
- SHA-256: 1EA3D5FB380D3C3C9C63BD83446CF43A768FFA26F6399C308F61B055EC484126
- SPKI SHA-256: 96FA8237FD5103BFFF53763624A338B3CF0413255336F4CB6FF91004E196E2B1
- Validity: 2012-04-26 to 2022-04-24
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.certum.pl/gsca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2e:23:db:35:f4:39:f7:bf:d1:58:e0:4d:57:53:17:a0
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA
        Validity
            Not Before: Apr 26 07:18:51 2012 GMT
            Not After : Apr 24 07:18:51 2022 GMT
        Subject: C = PL, O = NetArt Sp\C3\B3\C5\82ka Akcyjna S.K.A., OU = http://nazwa.pl, CN = nazwaSSL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/gsca.crl
            X509v3 Authority Key Identifier:
                45:C5:B2:86:4E:CC:DD:29:97:E4:DD:14:C4:6E:AE:4D:B8:C1:77:F8
            X509v3 Subject Key Identifier:
                9D:CE:F0:5A:B4:CB:25:CF:36:A5:82:5D:8F:F7:7F:98:46:19:37:2E
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 1EA3D5FB380D3C3C9C63BD83446CF43A768FFA26F6399C308F61B055EC484126
    SPKI SHA256: 96FA8237FD5103BFFF53763624A338B3CF0413255336F4CB6FF91004E196E2B1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.certum.pl/gsca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### nazwaSSL

- Subject: countryName=PL, organizationName=NetArt SpÃ³Åka Akcyjna S.K.A., organizationalUnitName=http://nazwa.pl, commonName=nazwaSSL
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA
- Serial: 435507AA1C573D95C0E50C44A4E6DACF
- SHA-256: E65D90DA756BCA30EE77007B3BF55A7B27A1BDFECC9AD6102A42E852EADD5B92
- SPKI SHA-256: 96FA8237FD5103BFFF53763624A338B3CF0413255336F4CB6FF91004E196E2B1
- Validity: 2012-07-06 to 2022-07-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/netartca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/gsca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            43:55:07:aa:1c:57:3d:95:c0:e5:0c:44:a4:e6:da:cf
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA
        Validity
            Not Before: Jul  6 10:31:40 2012 GMT
            Not After : Jul  4 10:31:40 2022 GMT
        Subject: C = PL, O = NetArt Sp\C3\83\C2\B3\C3\85\C2\82ka Akcyjna S.K.A., OU = http://nazwa.pl, CN = nazwaSSL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9D:CE:F0:5A:B4:CB:25:CF:36:A5:82:5D:8F:F7:7F:98:46:19:37:2E
            X509v3 Authority Key Identifier:
                45:C5:B2:86:4E:CC:DD:29:97:E4:DD:14:C4:6E:AE:4D:B8:C1:77:F8
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/gsca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gsca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E65D90DA756BCA30EE77007B3BF55A7B27A1BDFECC9AD6102A42E852EADD5B92
    SPKI SHA256: 96FA8237FD5103BFFF53763624A338B3CF0413255336F4CB6FF91004E196E2B1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gsca.cer
- CRL Distribution Points: http://crl.certum.pl/gsca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_wrong_time_format_pre2050: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### nazwaSSL

- Subject: countryName=PL, organizationName=nazwa.pl sp. z o.o., organizationalUnitName=http://nazwa.pl, commonName=nazwaSSL
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 606C62DC97D1A0392EE9CB12B21D6DD9
- SHA-256: A69C59966EBBCDFEC7F4FF0288C86FF60356FA7860208B93B43A095B0600CC1E
- SPKI SHA-256: 016E94F2A3EA935D78ADF976B008621229B63DFD26ABF45BFC17964A554088FE
- Validity: 2015-12-31 to 2025-12-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/nazwassl2sha2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            60:6c:62:dc:97:d1:a0:39:2e:e9:cb:12:b2:1d:6d:d9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Dec 31 10:05:42 2015 GMT
            Not After : Dec 28 10:05:42 2025 GMT
        Subject: C = PL, O = nazwa.pl sp. z o.o., OU = http://nazwa.pl, CN = nazwaSSL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Subject Key Identifier:
                54:DC:90:BB:9D:47:19:51:C3:79:68:2C:84:ED:2E:DF:5F:46:BA:C7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A69C59966EBBCDFEC7F4FF0288C86FF60356FA7860208B93B43A095B0600CC1E
    SPKI SHA256: 016E94F2A3EA935D78ADF976B008621229B63DFD26ABF45BFC17964A554088FE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_certificate_policies_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### nazwaSSL

- Subject: nazwaSSL
- Issuer: Certum Global Services CA
- Serial: -
- SHA-256: 363CDDBDE8BFE2E8D3DE0E32F8578A1FB676CBB76538A03FDE4DE3BD5BEB0497
- SPKI SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
- Validity: 2012-07-06 to 2022-07-04
- Key: unknown
- Signature Algorithm: -

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: -
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
SHA256 Fingerprint: 363CDDBDE8BFE2E8D3DE0E32F8578A1FB676CBB76538A03FDE4DE3BD5BEB0497
SPKI SHA256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
```

#### Extensions

- Basic Constraints: {"present":false,"critical":false,"ca":false,"path_len":null}
- Key Usage: -
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- is_ca
- is_expired

### nazwaSSL DV TLS G2 E29 CA

- Subject: countryName=PL, organizationName=nazwa.pl Sp. z o.o., commonName=nazwaSSL DV TLS G2 E29 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum EC-384 CA
- Serial: B8FF01A8B6586AF72FE313D2D2B45F14
- SHA-256: 7F02E351F89B119741B01D1371CA1B9C14ED8B34D640BA44EFC3ABB9FEBBE7C8
- SPKI SHA-256: 9B0260BC4D0FB2C41D183ACC27FA4DBD2AC631332657C11A1AB8D4D019D1FD97
- Validity: 2024-08-20 to 2029-08-14
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://nazwassldvtlsg2e29ca.crl.certum.pl/nazwassldvtlsg2e29ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b8:ff:01:a8:b6:58:6a:f7:2f:e3:13:d2:d2:b4:5f:14
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum EC-384 CA
        Validity
            Not Before: Aug 20 09:37:15 2024 GMT
            Not After : Aug 14 09:37:15 2029 GMT
        Subject: C = PL, O = nazwa.pl Sp. z o.o., CN = nazwaSSL DV TLS G2 E29 CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/cec384ca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8D:06:66:74:24:76:3A:F3:89:F7:BC:D6:BD:47:7D:2F:BC:10:5F:4B
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/cec384ca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                A0:EA:D4:0B:0F:49:FA:43:10:E4:5B:BF:C0:23:FF:5C:14:CE:A4:2C
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 7F02E351F89B119741B01D1371CA1B9C14ED8B34D640BA44EFC3ABB9FEBBE7C8
    SPKI SHA256: 9B0260BC4D0FB2C41D183ACC27FA4DBD2AC631332657C11A1AB8D4D019D1FD97
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/cec384ca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### nazwaSSL DV TLS G2 R29 CA

- Subject: countryName=PL, organizationName=nazwa.pl Sp. z o.o., commonName=nazwaSSL DV TLS G2 R29 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: A18B344928074C327BDA047EE59104CE
- SHA-256: AA0C4B7801B09FB77E423C91331EFB62A5A2A8B23A9D7C997E6A9BEEA435D2BF
- SPKI SHA-256: F65F826ABCC15CAC0C479CE744673BB81D867D7D1B690706B7A35117A2FEFFF1
- Validity: 2024-08-20 to 2029-08-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://nazwassldvtlsg2r29ca.crl.certum.pl/nazwassldvtlsg2r29ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            a1:8b:34:49:28:07:4c:32:7b:da:04:7e:e5:91:04:ce
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Aug 20 09:30:12 2024 GMT
            Not After : Aug 14 09:30:12 2029 GMT
        Subject: C = PL, O = nazwa.pl Sp. z o.o., CN = nazwaSSL DV TLS G2 R29 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F9:51:FB:C9:4B:F3:2F:5C:CE:0F:0D:C3:22:D9:B7:4B:27:BC:C1:AA
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: AA0C4B7801B09FB77E423C91331EFB62A5A2A8B23A9D7C997E6A9BEEA435D2BF
    SPKI SHA256: F65F826ABCC15CAC0C479CE744673BB81D867D7D1B690706B7A35117A2FEFFF1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### netartSSL

- Subject: countryName=PL, organizationName=netart.com sp. z o.o., commonName=netartSSL
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 4566BBEA77B9B40DC6867FECCD158C99
- SHA-256: 5A86CB297E37CFF1DB01FEA8E14FE4C5E054F8B228E976E4A782E3AEA723FC1B
- SPKI SHA-256: E5A25F313FCFBBEAF8494E9CE318869D5E9BF204CDBED49A48DB1172B3BC977D
- Validity: 2023-05-10 to 2027-05-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://netartcadv2.crl.certum.pl/netartcadv2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:66:bb:ea:77:b9:b4:0d:c6:86:7f:ec:cd:15:8c:99
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: May 10 09:28:20 2023 GMT
            Not After : May 20 09:28:20 2027 GMT
        Subject: C = PL, O = netart.com sp. z o.o., CN = netartSSL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                6A:8F:32:FE:B9:D2:00:BD:F0:7B:64:29:69:27:4D:A9:04:02:CA:C2
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5A86CB297E37CFF1DB01FEA8E14FE4C5E054F8B228E976E4A782E3AEA723FC1B
    SPKI SHA256: E5A25F313FCFBBEAF8494E9CE318869D5E9BF204CDBED49A48DB1172B3BC977D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### netartSSL

- Subject: countryName=PL, organizationName=netart.com sp. z o.o., commonName=netartSSL
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: D32C4556DD4ACFE0284D1368DC837580
- SHA-256: E21A784343F763F5EFE894DDC81E0B5B92A89DF65056FCA8C49AD4414CD74EB4
- SPKI SHA-256: 29AB3374BB5BA82FC27B43D5170FE4DFCB16F93F03B353838EC623DC3B5258C7
- Validity: 2023-01-23 to 2027-05-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://crl.certum.pl/netartcadv.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d3:2c:45:56:dd:4a:cf:e0:28:4d:13:68:dc:83:75:80
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jan 23 09:01:59 2023 GMT
            Not After : May 20 09:01:59 2027 GMT
        Subject: C = PL, O = netart.com sp. z o.o., CN = netartSSL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                63:C4:36:A4:A1:74:8C:52:89:87:6A:DC:59:62:0C:C6:75:CE:B5:BC
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E21A784343F763F5EFE894DDC81E0B5B92A89DF65056FCA8C49AD4414CD74EB4
    SPKI SHA256: 29AB3374BB5BA82FC27B43D5170FE4DFCB16F93F03B353838EC623DC3B5258C7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### netartSSL DV TLS G2 E31 CA

- Subject: countryName=PL, organizationName=netart.com sp. z o.o., commonName=netartSSL DV TLS G2 E31 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum EC-384 CA
- Serial: 0189C5931C28A3E4B855574F15F3C908
- SHA-256: B86D04DF2AF712C87B62882E521A13DB26A4C5456017E58F445E529958A79F41
- SPKI SHA-256: 1780160C57E8E4AE229E2F57AA572737F79B559067A1FBD0A4A898AEB93C9B45
- Validity: 2026-06-17 to 2031-06-06
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://netartssldvtlsg2e31ca.crl.certum.pl/netartssldvtlsg2e31ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:89:c5:93:1c:28:a3:e4:b8:55:57:4f:15:f3:c9:08
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum EC-384 CA
        Validity
            Not Before: Jun 17 07:34:32 2026 GMT
            Not After : Jun  6 07:34:32 2031 GMT
        Subject: C = PL, O = netart.com sp. z o.o., CN = netartSSL DV TLS G2 E31 CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/cec384ca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8D:06:66:74:24:76:3A:F3:89:F7:BC:D6:BD:47:7D:2F:BC:10:5F:4B
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/cec384ca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                18:AD:5D:09:AA:8B:FA:38:23:21:F1:64:33:35:27:7D:18:4C:BF:BA
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: B86D04DF2AF712C87B62882E521A13DB26A4C5456017E58F445E529958A79F41
    SPKI SHA256: 1780160C57E8E4AE229E2F57AA572737F79B559067A1FBD0A4A898AEB93C9B45
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/cec384ca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Nya Labs CA

- Subject: countryName=US, organizationName=NYA LABS LLC, commonName=Nya Labs CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 8B794BAFFB43501C11D1A3D583EC4CFA
- SHA-256: 7E0A8C9844D0F99EC84307483F2E331980749F88A7185649D4D99FA3C3589E52
- SPKI SHA-256: 5C8375EC0C7E27ED3A73A49035819E0E89021D11F51C5323006F874342512174
- Validity: 2023-11-02 to 2027-05-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://nyalabscadv.crl.certum.pl/nyalabscadv.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            8b:79:4b:af:fb:43:50:1c:11:d1:a3:d5:83:ec:4c:fa
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Nov  2 08:47:22 2023 GMT
            Not After : May 22 08:47:22 2027 GMT
        Subject: C = US, O = NYA LABS LLC, CN = Nya Labs CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AA:92:F5:3F:79:8D:5D:71:2C:0A:FF:AC:D8:A6:F9:7D:3C:83:5C:57
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7E0A8C9844D0F99EC84307483F2E331980749F88A7185649D4D99FA3C3589E52
    SPKI SHA256: 5C8375EC0C7E27ED3A73A49035819E0E89021D11F51C5323006F874342512174
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Nyatwork

- Subject: countryName=CA, organizationName=Nyatwork Communication Ltd, commonName=Nyatwork
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: FB512F8FE205EA41401929C6D3DFEBDF
- SHA-256: 2A6286C3AC09AE6CD3748B24A33F30FB93DA991F883F7002824B14A914955855
- SPKI SHA-256: A348E3C736C8B7C8E3F33693E8814EC390777D402DD46A4D85F355A8CEE00156
- Validity: 2021-10-19 to 2026-10-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://nyatworkdv.crl.certum.pl/nyatworkdv.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            fb:51:2f:8f:e2:05:ea:41:40:19:29:c6:d3:df:eb:df
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Oct 19 07:59:54 2021 GMT
            Not After : Oct 19 07:59:54 2026 GMT
        Subject: C = CA, O = Nyatwork Communication Ltd, CN = Nyatwork
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                88:82:FF:9E:A1:68:75:00:B1:99:60:26:4C:22:CB:EB:2A:E9:1F:53
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2A6286C3AC09AE6CD3748B24A33F30FB93DA991F883F7002824B14A914955855
    SPKI SHA256: A348E3C736C8B7C8E3F33693E8814EC390777D402DD46A4D85F355A8CEE00156
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### OKCERT R4 DV SSL CA G2

- Subject: countryName=CN, organizationName=Kingnet Information Technology Co., Ltd., organizationalUnitName=Kingnettech, commonName=OKCERT R4 DV SSL CA G2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 69C0570D6E2146319AD1E5834E049DCC
- SHA-256: 7EB445EA38A46A6411F0A12A0E16CD3D073E91B125679977041FFBCE83BE3C1A
- SPKI SHA-256: 63D244D8D890DC0AE17897769394450FB2719DB43381F2584B667425F1BAE14A
- Validity: 2019-06-12 to 2027-05-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://kingnettechdv.crl.certum.pl/kingnettechdv.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            69:c0:57:0d:6e:21:46:31:9a:d1:e5:83:4e:04:9d:cc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jun 12 08:10:07 2019 GMT
            Not After : May 21 08:10:07 2027 GMT
        Subject: C = CN, O = "Kingnet Information Technology Co., Ltd.", OU = Kingnettech, CN = OKCERT R4 DV SSL CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                BA:DE:F2:41:FE:1D:33:5A:82:47:95:ED:28:1A:18:56:FA:6F:B4:D2
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7EB445EA38A46A6411F0A12A0E16CD3D073E91B125679977041FFBCE83BE3C1A
    SPKI SHA256: 63D244D8D890DC0AE17897769394450FB2719DB43381F2584B667425F1BAE14A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### OKCERT R4 EV SSL CA G2

- Subject: countryName=CN, organizationName=Kingnet Information Technology Co., Ltd., organizationalUnitName=Kingnettech, commonName=OKCERT R4 EV SSL CA G2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 13109CBCD429EAE881F09E215F2DED38
- SHA-256: C5453F7C147016A9AA0F5F4BB1D217DEBE1C2D368C53CF74D35F55C5233C498A
- SPKI SHA-256: 7C574550489ECA336CF4372DA4413A7D2237141E7A575873689322148A344679
- Validity: 2019-06-12 to 2027-05-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://kingnettechev.crl.certum.pl/kingnettechev.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            13:10:9c:bc:d4:29:ea:e8:81:f0:9e:21:5f:2d:ed:38
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jun 12 08:12:09 2019 GMT
            Not After : May 21 08:12:09 2027 GMT
        Subject: C = CN, O = "Kingnet Information Technology Co., Ltd.", OU = Kingnettech, CN = OKCERT R4 EV SSL CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                34:3A:39:B2:2F:73:32:0D:23:2C:7A:6F:FA:80:FB:02:9F:44:7D:3A
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C5453F7C147016A9AA0F5F4BB1D217DEBE1C2D368C53CF74D35F55C5233C498A
    SPKI SHA256: 7C574550489ECA336CF4372DA4413A7D2237141E7A575873689322148A344679
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### OKCERT R4 OV SSL CA G2

- Subject: countryName=CN, organizationName=Kingnet Information Technology Co., Ltd., organizationalUnitName=Kingnettech, commonName=OKCERT R4 OV SSL CA G2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: EC4E0EB6AB2A278A66CF3B0D619A9D82
- SHA-256: BCC3A54D7083116316CE03B9A40CA36F336F4839AC581862D4311A84F701514D
- SPKI SHA-256: 27F2CDC8B3EEA16D49700846E9E1BE6C7318846A4DE5BF8CFC71C7779EA19F35
- Validity: 2019-06-12 to 2027-05-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://kingnettechov.crl.certum.pl/kingnettechov.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ec:4e:0e:b6:ab:2a:27:8a:66:cf:3b:0d:61:9a:9d:82
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jun 12 08:12:51 2019 GMT
            Not After : May 21 08:12:51 2027 GMT
        Subject: C = CN, O = "Kingnet Information Technology Co., Ltd.", OU = Kingnettech, CN = OKCERT R4 OV SSL CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                85:32:18:FF:77:9A:C9:91:80:D8:1B:91:17:BA:14:40:02:31:6A:42
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BCC3A54D7083116316CE03B9A40CA36F336F4839AC581862D4311A84F701514D
    SPKI SHA256: 27F2CDC8B3EEA16D49700846E9E1BE6C7318846A4DE5BF8CFC71C7779EA19F35
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Onmime SMIME G1 R36 CA

- Subject: countryName=TR, organizationName=Ondokuzon Yazilim AS, commonName=Onmime SMIME G1 R36 CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA 2
- Serial: DAEB64197C590065C46E765E8AF2423D
- SHA-256: 1FF248F20CBDC78546D8B3B59533E7D1647A5CBF3C217A357C3D8FF4566EE7B7
- SPKI SHA-256: 9174F36DD8568F03B69433AEBBAD28A1BF5801749C5B3DD62D9AB7D79442456B
- Validity: 2026-02-11 to 2036-01-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://onmimesmimeg1r36ca.crl.certum.pl/onmimesmimeg1r36ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            da:eb:64:19:7c:59:00:65:c4:6e:76:5e:8a:f2:42:3d
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA 2
        Validity
            Not Before: Feb 11 09:13:23 2026 GMT
            Not After : Jan 30 09:13:23 2036 GMT
        Subject: C = TR, O = Ondokuzon Yazilim AS, CN = Onmime SMIME G1 R36 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctnca2.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                B6:A1:54:39:02:C3:A0:3F:8E:8A:BC:FA:D4:F8:1C:A6:D1:3A:0E:FD
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca2.crl
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                DA:C9:33:69:3F:24:BE:92:CB:41:88:1E:88:F9:08:56:28:80:20:5B
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 1FF248F20CBDC78546D8B3B59533E7D1647A5CBF3C217A357C3D8FF4566EE7B7
    SPKI SHA256: 9174F36DD8568F03B69433AEBBAD28A1BF5801749C5B3DD62D9AB7D79442456B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctnca2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### QIDUOCA 2018 DV SSL

- Subject: countryName=CN, organizationName=Suzhou Qiduo Information Technology Co., Ltd., organizationalUnitName=Domain Validated SSL, commonName=QIDUOCA 2018 DV SSL
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: D8F02E7002E2F53FA539EA253A264D3A
- SHA-256: E372221266A330DD13EB1388DFAAF1FAB11DF254B63385CB637BFEF8FB5FB675
- SPKI SHA-256: 1E34F5D6EC5BD1D5D7C599E1E8552611654750BB52B4F6752CBCD161D91DA2A6
- Validity: 2018-08-22 to 2027-05-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://qiduodv.crl.certum.pl/qiduodv.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d8:f0:2e:70:02:e2:f5:3f:a5:39:ea:25:3a:26:4d:3a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Aug 22 07:14:49 2018 GMT
            Not After : May  2 07:14:49 2027 GMT
        Subject: C = CN, O = "Suzhou Qiduo Information Technology Co., Ltd.", OU = Domain Validated SSL, CN = QIDUOCA 2018 DV SSL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                20:A3:08:32:AE:D7:86:12:F8:F3:C6:3F:13:C7:69:6D:D0:88:71:DD
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E372221266A330DD13EB1388DFAAF1FAB11DF254B63385CB637BFEF8FB5FB675
    SPKI SHA256: 1E34F5D6EC5BD1D5D7C599E1E8552611654750BB52B4F6752CBCD161D91DA2A6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Root CA - G3

- Subject: countryName=US, organizationName=Root Networks, LLC, commonName=Root CA - G3
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: C3E00F9F002EC559BA02C4A5F2600C5F
- SHA-256: 6C834388F2A0D06949C63EFCF30D77782E25A8250135939E54960214540EEA45
- SPKI SHA-256: BA305F3267D35FFDDD096415F3D658D93C38AA115FDAF90366BAEACC2765C5F5
- Validity: 2020-09-09 to 2028-09-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/rootnetworksdv.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c3:e0:0f:9f:00:2e:c5:59:ba:02:c4:a5:f2:60:0c:5f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Sep  9 08:02:54 2020 GMT
            Not After : Sep  9 08:02:54 2028 GMT
        Subject: C = US, O = "Root Networks, LLC", CN = Root CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                97:51:F1:88:CB:DD:5D:1F:60:71:0C:BA:37:0B:0F:FE:68:33:B4:B3
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6C834388F2A0D06949C63EFCF30D77782E25A8250135939E54960214540EEA45
    SPKI SHA256: BA305F3267D35FFDDD096415F3D658D93C38AA115FDAF90366BAEACC2765C5F5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Root Global CA - G2

- Subject: countryName=US, organizationName=Root Networks, LLC, commonName=Root Global CA - G2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: C3E00F9F002EC559BA02C4A5F2600C5E
- SHA-256: 309A7823BB3D1DDF44A573EC0BF9FD5166625FDE73776184C62212B4C0B4E94E
- SPKI SHA-256: 4963048BC2DA04CBE18AF49E3C3EA2A974C0A1A6BF5C2C466873A7A741306D15
- Validity: 2020-01-30 to 2027-05-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://rootglobaldv.crl.certum.pl/rootglobaldv.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c3:e0:0f:9f:00:2e:c5:59:ba:02:c4:a5:f2:60:0c:5e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jan 30 12:23:14 2020 GMT
            Not After : May 20 12:23:14 2027 GMT
        Subject: C = US, O = "Root Networks, LLC", CN = Root Global CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B1:C0:46:71:EF:A8:8E:0D:41:CA:5F:9B:95:2A:02:EE:2C:62:11:4B
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 309A7823BB3D1DDF44A573EC0BF9FD5166625FDE73776184C62212B4C0B4E94E
    SPKI SHA256: 4963048BC2DA04CBE18AF49E3C3EA2A974C0A1A6BF5C2C466873A7A741306D15
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Root Networks CA

- Subject: countryName=US, organizationName=Root Networks, LLC, commonName=Root Networks CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: F9C8E2531E1B7689499D5C276916DF97
- SHA-256: BF64C06D1D48D977A0BC2DFC917E8E0D6342BD11590471636D7A0806CC8DF003
- SPKI SHA-256: 69277E30CB2A946BB9EE39E2F6BA0587286FACC40C95A4151E0A4C419DF1033F
- Validity: 2023-05-15 to 2028-09-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://rootnetworksdv2.crl.certum.pl/rootnetworksdv2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            f9:c8:e2:53:1e:1b:76:89:49:9d:5c:27:69:16:df:97
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: May 15 12:53:13 2023 GMT
            Not After : Sep  9 12:53:13 2028 GMT
        Subject: C = US, O = "Root Networks, LLC", CN = Root Networks CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                18:06:CD:5D:D7:9B:56:BA:02:E6:23:2E:4D:7C:1A:FD:1D:F0:C9:CB
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BF64C06D1D48D977A0BC2DFC917E8E0D6342BD11590471636D7A0806CC8DF003
    SPKI SHA256: 69277E30CB2A946BB9EE39E2F6BA0587286FACC40C95A4151E0A4C419DF1033F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Shoper DV TLS G2 R34 CA

- Subject: countryName=PL, organizationName=Shoper S.A., commonName=Shoper DV TLS G2 R34 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 98FF877B6D6D5E77A325F393049FAD8C
- SHA-256: 509ABBB92864C2C44D7CBC466B63950E350165EE772A3037AE8168E92226A46F
- SPKI SHA-256: FA0E97E748B0D4A8C4CAA740B0EBD37BB219DC285A128FCFD1432EB8D587A78B
- Validity: 2024-05-28 to 2034-05-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://shoperdvtlsg2r34ca.crl.certum.pl/shoperdvtlsg2r34ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            98:ff:87:7b:6d:6d:5e:77:a3:25:f3:93:04:9f:ad:8c
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: May 28 08:55:16 2024 GMT
            Not After : May 16 08:55:16 2034 GMT
        Subject: C = PL, O = Shoper S.A., CN = Shoper DV TLS G2 R34 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                D6:35:68:1A:1E:F4:6C:61:86:D3:FC:4A:28:7A:45:5A:43:6C:B4:AC
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 509ABBB92864C2C44D7CBC466B63950E350165EE772A3037AE8168E92226A46F
    SPKI SHA256: FA0E97E748B0D4A8C4CAA740B0EBD37BB219DC285A128FCFD1432EB8D587A78B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Shoper® SSL

- Subject: countryName=PL, organizationName=Dreamcommerce S.A., organizationalUnitName=Dreamcommerce S.A., commonName=Shoper® SSL
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 4E4F65E01F6B735AFE9C072C607C4ABF
- SHA-256: 277CF4B65F530FCC07285EF89D8311884884004E4F2C7DBE7CA006E96536CD62
- SPKI SHA-256: BB6AB346B01D98DAFE31ECACBA98BDC7B50D31A2D8673B93E0E4D3867FFAC45E
- Validity: 2014-09-30 to 2024-09-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/shopersslsha2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4e:4f:65:e0:1f:6b:73:5a:fe:9c:07:2c:60:7c:4a:bf
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Sep 30 11:54:40 2014 GMT
            Not After : Sep 27 11:54:40 2024 GMT
        Subject: C = PL, O = Dreamcommerce S.A., OU = Dreamcommerce S.A., CN = Shoper\C2\AE SSL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Subject Key Identifier:
                64:D9:7C:E6:02:06:1B:45:0B:3D:75:58:98:4A:46:07:60:35:9D:C1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 277CF4B65F530FCC07285EF89D8311884884004E4F2C7DBE7CA006E96536CD62
    SPKI SHA256: BB6AB346B01D98DAFE31ECACBA98BDC7B50D31A2D8673B93E0E4D3867FFAC45E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_certificate_policies_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Shoper® SSL

- Subject: countryName=PL, organizationName=Dreamcommerce S.A., organizationalUnitName=Dreamcommerce S.A., commonName=ShoperÂ® SSL
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA
- Serial: FF864600BE586F4E01AABFE8641D00CD
- SHA-256: 9BAA73028F3F1F6D38A37BEC6DF57616B6EF3ED1AFD0B995E8BBB21127565AB4
- SPKI SHA-256: 260B7BA202AD4EBDF85BF1FC0FA7AE95B9DACB2A1775CC7E2DB5D61C5F7678F7
- Validity: 2012-06-15 to 2022-06-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/shoper.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/gsca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ff:86:46:00:be:58:6f:4e:01:aa:bf:e8:64:1d:00:cd
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA
        Validity
            Not Before: Jun 15 12:13:09 2012 GMT
            Not After : Jun 13 12:13:09 2022 GMT
        Subject: C = PL, O = Dreamcommerce S.A., OU = Dreamcommerce S.A., CN = Shoper\C3\82\C2\AE SSL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F2:B4:11:F6:ED:39:2A:1D:4A:76:9F:03:9D:28:08:26:96:C1:5C:DF
            X509v3 Authority Key Identifier:
                45:C5:B2:86:4E:CC:DD:29:97:E4:DD:14:C4:6E:AE:4D:B8:C1:77:F8
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/gsca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gsca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9BAA73028F3F1F6D38A37BEC6DF57616B6EF3ED1AFD0B995E8BBB21127565AB4
    SPKI SHA256: 260B7BA202AD4EBDF85BF1FC0FA7AE95B9DACB2A1775CC7E2DB5D61C5F7678F7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gsca.cer
- CRL Distribution Points: http://crl.certum.pl/gsca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_wrong_time_format_pre2050: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Shoper® SSL

- Subject: Shoper® SSL
- Issuer: Certum Global Services CA
- Serial: -
- SHA-256: 45E0E9FA188DF98F379480F01B64BAC62CFE0975E6BB21C7D26DD8A8A161978B
- SPKI SHA-256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
- Validity: 2012-06-15 to 2022-06-13
- Key: unknown
- Signature Algorithm: -

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: -
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
SHA256 Fingerprint: 45E0E9FA188DF98F379480F01B64BAC62CFE0975E6BB21C7D26DD8A8A161978B
SPKI SHA256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
```

#### Extensions

- Basic Constraints: {"present":false,"critical":false,"ca":false,"path_len":null}
- Key Usage: -
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- is_ca
- is_expired

### Shuidi Webtrust SSL Domain Validated

- Subject: countryName=CN, organizationName=Shanghai Ping An Credit Reference Company Limited, commonName=Shuidi Webtrust SSL Domain Validated
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 9073D7674C9CBA7BBE10706593DD7233
- SHA-256: 4D67237B2CFACFFF3DDC83C2FF1C92A8E0A98A71BD04ED39F8AFF42AAF99371D
- SPKI SHA-256: CFC52F65523268E4E4268B25D959FC1DB727EC284A0A8B0512628182F44B87A5
- Validity: 2019-02-07 to 2027-05-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://shuididv.crl.certum.pl/shuididv.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            90:73:d7:67:4c:9c:ba:7b:be:10:70:65:93:dd:72:33
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Feb  7 09:14:08 2019 GMT
            Not After : May 21 09:14:08 2027 GMT
        Subject: C = CN, O = Shanghai Ping An Credit Reference Company Limited, CN = Shuidi Webtrust SSL Domain Validated
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                2C:6C:D1:03:C8:6D:1A:D8:B8:65:C3:6C:BD:66:EF:92:21:9F:6D:D8
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4D67237B2CFACFFF3DDC83C2FF1C92A8E0A98A71BD04ED39F8AFF42AAF99371D
    SPKI SHA256: CFC52F65523268E4E4268B25D959FC1DB727EC284A0A8B0512628182F44B87A5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Shuidi Webtrust SSL Extended Validated

- Subject: countryName=CN, organizationName=Shanghai Ping An Credit Reference Company Limited, commonName=Shuidi Webtrust SSL Extended Validated
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: A51D3444BCDEB1F33240001BD58D2138
- SHA-256: 6C40D07F4705A5B4F04C6AECDC5A1BF5FD38D2B6CF2DB7F212CA251075BE125D
- SPKI SHA-256: 600458F0CE293554234AC9395E0C3E3776FB65A42CB14DFE325DAAE5CE793F54
- Validity: 2019-02-07 to 2027-05-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://shuidiev.crl.certum.pl/shuidiev.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            a5:1d:34:44:bc:de:b1:f3:32:40:00:1b:d5:8d:21:38
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Feb  7 09:18:47 2019 GMT
            Not After : May 21 09:18:47 2027 GMT
        Subject: C = CN, O = Shanghai Ping An Credit Reference Company Limited, CN = Shuidi Webtrust SSL Extended Validated
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D5:BE:84:76:49:45:2F:AF:F8:0F:32:8C:CE:AF:D7:82:42:AC:04:5B
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6C40D07F4705A5B4F04C6AECDC5A1BF5FD38D2B6CF2DB7F212CA251075BE125D
    SPKI SHA256: 600458F0CE293554234AC9395E0C3E3776FB65A42CB14DFE325DAAE5CE793F54
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Shuidi Webtrust SSL Organization Validated

- Subject: countryName=CN, organizationName=Shanghai Ping An Credit Reference Company Limited, commonName=Shuidi Webtrust SSL Organization Validated
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: B3780C84DB0D041B1CD66A40CB8D9573
- SHA-256: EE09D49C7CF441840DA5158D0E70D4C6CAEB4FCCFE6758EE4CC45C71A287DF39
- SPKI SHA-256: 6D0129552FCFD93689048860A445C10BC8C7A972E5A12F5BE0490A7F75882C4F
- Validity: 2019-02-07 to 2027-05-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://shuidiov.crl.certum.pl/shuidiov.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b3:78:0c:84:db:0d:04:1b:1c:d6:6a:40:cb:8d:95:73
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Feb  7 09:17:34 2019 GMT
            Not After : May 21 09:17:34 2027 GMT
        Subject: C = CN, O = Shanghai Ping An Credit Reference Company Limited, CN = Shuidi Webtrust SSL Organization Validated
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E8:46:10:C7:72:9E:3F:29:F1:CE:74:7A:C2:55:96:6F:20:25:A8:42
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EE09D49C7CF441840DA5158D0E70D4C6CAEB4FCCFE6758EE4CC45C71A287DF39
    SPKI SHA256: 6D0129552FCFD93689048860A445C10BC8C7A972E5A12F5BE0490A7F75882C4F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Sooma Digital Trust Validation

- Subject: countryName=PT, organizationName=Sooma.com Web Services Lda, commonName=Sooma Digital Trust Validation
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 40103C009518C0E91C1361E37A3B95AA
- SHA-256: CF8F3E3A993C9D020068B7AB200AC94200748731822FD5B32767226A2EE4EFA5
- SPKI SHA-256: 2C04D9D49D3A007AAB93D56C3478F678B14B105964A80776490E32DE1AB3CCDD
- Validity: 2023-01-23 to 2027-05-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://soomadv.crl.certum.pl/soomadv.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            40:10:3c:00:95:18:c0:e9:1c:13:61:e3:7a:3b:95:aa
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jan 23 09:07:16 2023 GMT
            Not After : May 20 09:07:16 2027 GMT
        Subject: C = PT, O = Sooma.com Web Services Lda, CN = Sooma Digital Trust Validation
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                9F:E3:F4:87:C2:D3:94:D3:04:10:D5:3A:57:1D:78:22:D9:38:46:5F
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CF8F3E3A993C9D020068B7AB200AC94200748731822FD5B32767226A2EE4EFA5
    SPKI SHA256: 2C04D9D49D3A007AAB93D56C3478F678B14B105964A80776490E32DE1AB3CCDD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### SpaceSSL CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=SpaceSSL Certification Authority, commonName=SpaceSSL CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA
- Serial: 2539661F537D7B5CEA2C999DB63C083E
- SHA-256: 3A29828F3DDCA85FBD18628A052476431360AD67E89420282771C1236207D43C
- SPKI SHA-256: 467DF2EEFF6D1A02D081E5D1CF893BD48D1BC03A6D602BDBDBB3F4976B889982
- Validity: 2014-04-16 to 2024-03-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/spacesslca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/gsca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            25:39:66:1f:53:7d:7b:5c:ea:2c:99:9d:b6:3c:08:3e
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA
        Validity
            Not Before: Apr 16 14:00:00 2014 GMT
            Not After : Mar  2 11:00:00 2024 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = SpaceSSL Certification Authority, CN = SpaceSSL CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/gsca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gsca.cer
            X509v3 Authority Key Identifier:
                45:C5:B2:86:4E:CC:DD:29:97:E4:DD:14:C4:6E:AE:4D:B8:C1:77:F8
            X509v3 Subject Key Identifier:
                EF:AC:69:D7:5C:51:5D:7B:76:00:F0:F8:99:B4:2B:CC:19:84:0D:89
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3A29828F3DDCA85FBD18628A052476431360AD67E89420282771C1236207D43C
    SPKI SHA256: 467DF2EEFF6D1A02D081E5D1CF893BD48D1BC03A6D602BDBDBB3F4976B889982
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gsca.cer
- CRL Distribution Points: http://crl.certum.pl/gsca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_certificate_policies_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### SpaceSSL CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=SpaceSSL Certification Authority, commonName=SpaceSSL CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA
- Serial: 4CB049E30E8915D38430C1178875CCD4
- SHA-256: 619ED5ADE1F1862446D23F792F2CA3D53E6AF107B07A465DF71DC61AEDC42E2B
- SPKI SHA-256: 467DF2EEFF6D1A02D081E5D1CF893BD48D1BC03A6D602BDBDBB3F4976B889982
- Validity: 2014-03-14 to 2024-03-11
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/gsca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4c:b0:49:e3:0e:89:15:d3:84:30:c1:17:88:75:cc:d4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA
        Validity
            Not Before: Mar 14 12:30:30 2014 GMT
            Not After : Mar 11 12:30:30 2024 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = SpaceSSL Certification Authority, CN = SpaceSSL CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/gsca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gsca.cer
            X509v3 Authority Key Identifier:
                45:C5:B2:86:4E:CC:DD:29:97:E4:DD:14:C4:6E:AE:4D:B8:C1:77:F8
            X509v3 Subject Key Identifier:
                EF:AC:69:D7:5C:51:5D:7B:76:00:F0:F8:99:B4:2B:CC:19:84:0D:89
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 619ED5ADE1F1862446D23F792F2CA3D53E6AF107B07A465DF71DC61AEDC42E2B
    SPKI SHA256: 467DF2EEFF6D1A02D081E5D1CF893BD48D1BC03A6D602BDBDBB3F4976B889982
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gsca.cer
- CRL Distribution Points: http://crl.certum.pl/gsca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_certificate_policies_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### SpaceSSL CA

- Subject: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=SpaceSSL Certification Authority, commonName=SpaceSSL CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 3D5DFFF1EB3144FC808CFA46BF8CC17B
- SHA-256: 65DE322A1EF7AFFEDEB7387138C26060825B08CC27E1992DD9EAC8337297957B
- SPKI SHA-256: 00E5F2E90785457AF72DEDA3CBD5541D57344D8E8DA1F0D0B1E15071A0D1968C
- Validity: 2014-09-30 to 2024-09-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/spacesslcasha2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3d:5d:ff:f1:eb:31:44:fc:80:8c:fa:46:bf:8c:c1:7b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Sep 30 11:55:21 2014 GMT
            Not After : Sep 27 11:55:21 2024 GMT
        Subject: C = PL, O = Unizeto Technologies S.A., OU = SpaceSSL Certification Authority, CN = SpaceSSL CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Subject Key Identifier:
                9B:D2:02:D8:92:16:22:C2:68:DC:65:8A:E1:DB:B4:7D:CB:4B:CD:D0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 65DE322A1EF7AFFEDEB7387138C26060825B08CC27E1992DD9EAC8337297957B
    SPKI SHA256: 00E5F2E90785457AF72DEDA3CBD5541D57344D8E8DA1F0D0B1E15071A0D1968C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_certificate_policies_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### SSL Secure Site CA

- Subject: countryName=GB, organizationName=SSL Limited, commonName=SSL Secure Site CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 670033AEB205D5417F34DDDC3E94B562
- SHA-256: D859828E4E8C35ECC38E415E1D0CFFD4A9DFC116205401D1298FC13347DC0187
- SPKI SHA-256: 14C57636DF81C094C7915A040FAD26FEA27FEA1E7F3DC54308034660FB884C8C
- Validity: 2022-09-29 to 2027-09-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://ssllimiteddv.crl.certum.pl/ssllimiteddv.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            67:00:33:ae:b2:05:d5:41:7f:34:dd:dc:3e:94:b5:62
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Sep 29 07:56:51 2022 GMT
            Not After : Sep 28 07:56:51 2027 GMT
        Subject: C = GB, O = SSL Limited, CN = SSL Secure Site CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                77:E8:94:CD:00:62:EE:9A:A2:35:9E:08:48:24:18:B3:1E:56:EB:74
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D859828E4E8C35ECC38E415E1D0CFFD4A9DFC116205401D1298FC13347DC0187
    SPKI SHA256: 14C57636DF81C094C7915A040FAD26FEA27FEA1E7F3DC54308034660FB884C8C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV Root Certification Authority RSA R2

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 62F812A35F52BD74B718D610AC4B4783
- SHA-256: B97176F21B6ED64609267B2D1A2A9FAF0C4DEBD44644DC85EB6AE986FC867D56
- SPKI SHA-256: 7CD67C248F69D83FC2F9BB01DCB1F7AD67A363D046043796D0984C3A231F6BB0
- Validity: 2018-09-11 to 2023-09-11
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS-v1.16.pdf, https://legal.ssl.com/documents/SSLcom-CP-CPS-v1.16.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4abb6f0c-a72d-40ca-90a1-1c40b140f75a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=46752846-7d64-424d-bdf4-9aba8564e584, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=adbc8c7c-930a-4dee-bcbf-b927ae2c5b3a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f8559916-8dae-43bb-a3f3-2c8b27315707
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 2
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://sslcom.ocsp-certum.com
- CRL DP: http://sslcom.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            62:f8:12:a3:5f:52:bd:74:b7:18:d6:10:ac:4b:47:83
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Sep 11 09:28:20 2018 GMT
            Not After : Sep 11 09:28:20 2023 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:2
            X509v3 Subject Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://sslcom.crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://sslcom.ocsp-certum.com
                CA Issuers - URI:http://sslcom.repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B97176F21B6ED64609267B2D1A2A9FAF0C4DEBD44644DC85EB6AE986FC867D56
    SPKI SHA256: 7CD67C248F69D83FC2F9BB01DCB1F7AD67A363D046043796D0984C3A231F6BB0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":2}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://sslcom.ocsp-certum.com
- AIA CA Issuers: http://sslcom.repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://sslcom.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### SSL.com Root Certification Authority RSA

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: E4270495F68C91D6D0EC7B494EA4DF1C
- SHA-256: ACF718DF838E640051777D1947F51620E8D804BA186553AE52FC9811B5D34B8B
- SPKI SHA-256: D1C45377EBDCD618CD1651DC2E02C21D751E5AA9FCD1B3431FF6ECF6A31348FA
- Validity: 2018-09-11 to 2023-09-11
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS-v1.16.pdf, https://legal.ssl.com/documents/SSLcom-CP-CPS-v1.16.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4abb6f0c-a72d-40ca-90a1-1c40b140f75a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=46752846-7d64-424d-bdf4-9aba8564e584, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=adbc8c7c-930a-4dee-bcbf-b927ae2c5b3a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f8559916-8dae-43bb-a3f3-2c8b27315707
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 2
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://sslcom.ocsp-certum.com
- CRL DP: http://sslcom.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Sep 11 09:26:47 2018 GMT
            Not After : Sep 11 09:26:47 2023 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:2
            X509v3 Subject Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://sslcom.crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://sslcom.ocsp-certum.com
                CA Issuers - URI:http://sslcom.repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: ACF718DF838E640051777D1947F51620E8D804BA186553AE52FC9811B5D34B8B
    SPKI SHA256: D1C45377EBDCD618CD1651DC2E02C21D751E5AA9FCD1B3431FF6ECF6A31348FA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":2}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://sslcom.ocsp-certum.com
- AIA CA Issuers: http://sslcom.repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://sslcom.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### SZCA DV SSL CA

- Subject: countryName=CN, organizationName=Shenzhen Digital Certificate Authority Center Co., Ltd, commonName=SZCA DV SSL CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: DB3AE99FCF6407D8DAEEF98CC77F8C13
- SHA-256: F6787FA8CAD7D2C279A0374BFB503807CC6ADCC7C23709273DD5A4047D1AEF78
- SPKI SHA-256: 3CF9F711166AEE9984AB8432C8FC41BBC2EF2718E23E53EC40B5531D86CEC1BA
- Validity: 2019-07-16 to 2027-05-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://shenzhendv.crl.certum.pl/shenzhendv.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            db:3a:e9:9f:cf:64:07:d8:da:ee:f9:8c:c7:7f:8c:13
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jul 16 09:50:52 2019 GMT
            Not After : May 21 09:50:52 2027 GMT
        Subject: C = CN, O = "Shenzhen Digital Certificate Authority Center Co., Ltd", CN = SZCA DV SSL CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                76:B3:B0:CB:F5:4E:91:21:B6:95:57:7B:83:0F:FC:15:B2:0A:1C:30
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F6787FA8CAD7D2C279A0374BFB503807CC6ADCC7C23709273DD5A4047D1AEF78
    SPKI SHA256: 3CF9F711166AEE9984AB8432C8FC41BBC2EF2718E23E53EC40B5531D86CEC1BA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### SZCA EV SSL CA

- Subject: countryName=CN, organizationName=Shenzhen Digital Certificate Authority Center Co., Ltd, commonName=SZCA EV SSL CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 4E0D59E13A1A08EB0DAE89E91B6750DA
- SHA-256: 7FBF5DB4917639930076AAFF78FC91DDA0EFEEA86CAD38A18D98947D7CD36948
- SPKI SHA-256: 9BD173925E277E2A7D444A7B986399E32852145E052F803EFBDA3B7944D8CCC4
- Validity: 2019-07-16 to 2027-05-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://shenzhenev.crl.certum.pl/shenzhenev.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4e:0d:59:e1:3a:1a:08:eb:0d:ae:89:e9:1b:67:50:da
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jul 16 09:53:14 2019 GMT
            Not After : May 21 09:53:14 2027 GMT
        Subject: C = CN, O = "Shenzhen Digital Certificate Authority Center Co., Ltd", CN = SZCA EV SSL CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B3:FE:DB:E4:49:95:D0:A1:00:FB:85:69:DD:9E:D2:0C:94:37:B0:CA
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7FBF5DB4917639930076AAFF78FC91DDA0EFEEA86CAD38A18D98947D7CD36948
    SPKI SHA256: 9BD173925E277E2A7D444A7B986399E32852145E052F803EFBDA3B7944D8CCC4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### SZCA OV SSL CA

- Subject: countryName=CN, organizationName=Shenzhen Digital Certificate Authority Center Co., Ltd, commonName=SZCA OV SSL CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 2036943CBEA08B692A296D66244064A2
- SHA-256: CC0B2512EE20280C36F30D57084ACB6B8636D94B481742E424335C7767E758C6
- SPKI SHA-256: 6C9EB6FFF3BD28CA2ECC63CC7E9375033811D45A733F7995694096CF3B391632
- Validity: 2019-07-16 to 2027-05-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://shenzhenov.crl.certum.pl/shenzhenov.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            20:36:94:3c:be:a0:8b:69:2a:29:6d:66:24:40:64:a2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jul 16 09:52:30 2019 GMT
            Not After : May 21 09:52:30 2027 GMT
        Subject: C = CN, O = "Shenzhen Digital Certificate Authority Center Co., Ltd", CN = SZCA OV SSL CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                2C:C6:10:A7:F4:14:EC:84:19:3F:B2:53:EC:98:CB:3C:C9:F7:57:64
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CC0B2512EE20280C36F30D57084ACB6B8636D94B481742E424335C7767E758C6
    SPKI SHA256: 6C9EB6FFF3BD28CA2ECC63CC7E9375033811D45A733F7995694096CF3B391632
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### TLC DV TLS CA

- Subject: countryName=CN, organizationName=泰尔认证中心有限公司, commonName=TLC DV TLS CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: AF4D6089D16ECE9A82F3F226A5C9A94A
- SHA-256: AA985028EE5CF60287E86159B11DA578727E7C7433B2DA6F53C183D032A9294D
- SPKI SHA-256: 788226CC7F0DD12DCF1A1BCFAFEC18C59DDBDA6C4F75DB33E3341547E5BDAF21
- Validity: 2024-12-17 to 2034-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://tlcdvtlsr34g2ca.crl.certum.pl/tlcdvtlsr34g2ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            af:4d:60:89:d1:6e:ce:9a:82:f3:f2:26:a5:c9:a9:4a
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Dec 17 10:08:53 2024 GMT
            Not After : Dec  5 10:08:53 2034 GMT
        Subject: C = CN, O = \E6\B3\B0\E5\B0\94\E8\AE\A4\E8\AF\81\E4\B8\AD\E5\BF\83\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = TLC DV TLS CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                63:BD:AD:94:8C:C4:94:36:10:1F:A9:DB:75:1A:99:06:47:8D:3F:48
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: AA985028EE5CF60287E86159B11DA578727E7C7433B2DA6F53C183D032A9294D
    SPKI SHA256: 788226CC7F0DD12DCF1A1BCFAFEC18C59DDBDA6C4F75DB33E3341547E5BDAF21
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TLC EV TLS CA

- Subject: countryName=CN, organizationName=泰尔认证中心有限公司, commonName=TLC EV TLS CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 419051280882D80366268B355359294D
- SHA-256: 2BAD3A42760061D221577E059B794A9A4B21F589ADE38BC280FEF790DC011E79
- SPKI SHA-256: D4C9287C5472436A34C36C44031E15D42256F5B8F436A591634C6BD970354AAF
- Validity: 2024-12-17 to 2034-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://tlcevtlsr34g2ca.crl.certum.pl/tlcevtlsr34g2ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            41:90:51:28:08:82:d8:03:66:26:8b:35:53:59:29:4d
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Dec 17 10:12:09 2024 GMT
            Not After : Dec  5 10:12:09 2034 GMT
        Subject: C = CN, O = \E6\B3\B0\E5\B0\94\E8\AE\A4\E8\AF\81\E4\B8\AD\E5\BF\83\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = TLC EV TLS CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                60:CF:1F:77:C4:E0:8E:91:67:30:BA:D1:7E:F6:7B:A0:52:06:6E:1D
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 2BAD3A42760061D221577E059B794A9A4B21F589ADE38BC280FEF790DC011E79
    SPKI SHA256: D4C9287C5472436A34C36C44031E15D42256F5B8F436A591634C6BD970354AAF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TLC OV TLS CA

- Subject: countryName=CN, organizationName=泰尔认证中心有限公司, commonName=TLC OV TLS CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: AEFE3D7A96A8704FF6063F279C447CE8
- SHA-256: DA99474EB4D1DA945FD6C13CD383B908E6F9BEA2E5108EB158F62EED8513C035
- SPKI SHA-256: 0F19389281EF1E38FF43B1236572C4FBF005036111FC69E2D9CD3BAEB80473B5
- Validity: 2024-12-17 to 2034-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://tlcovtlsr34g2ca.crl.certum.pl/tlcovtlsr34g2ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ae:fe:3d:7a:96:a8:70:4f:f6:06:3f:27:9c:44:7c:e8
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Dec 17 10:11:08 2024 GMT
            Not After : Dec  5 10:11:08 2034 GMT
        Subject: C = CN, O = \E6\B3\B0\E5\B0\94\E8\AE\A4\E8\AF\81\E4\B8\AD\E5\BF\83\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = TLC OV TLS CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                68:62:37:43:96:BD:48:CC:48:78:50:34:75:5E:FF:83:C5:E6:13:A7
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: DA99474EB4D1DA945FD6C13CD383B908E6F9BEA2E5108EB158F62EED8513C035
    SPKI SHA256: 0F19389281EF1E38FF43B1236572C4FBF005036111FC69E2D9CD3BAEB80473B5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia DV SSL CA - C3

- Subject: countryName=CN, organizationName=TrustAsia Technologies Inc., commonName=TrustAsia DV SSL CA - C3
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: F15CC09C2DCC610208B80EA3057243A9
- SHA-256: C25F1E96000BC36E2AA5CD54BF24F48B76890A162E1AD8E104992650510626C2
- SPKI SHA-256: 9190F5AC0872754718C7F8878B043EC6C87DDA275CE42AF2BECE3ED8C7909E99
- Validity: 2017-10-23 to 2027-05-14
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://trustasiadv.crl.certum.pl/trustasiadv.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            f1:5c:c0:9c:2d:cc:61:02:08:b8:0e:a3:05:72:43:a9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Oct 23 07:16:44 2017 GMT
            Not After : May 14 07:16:44 2027 GMT
        Subject: C = CN, O = TrustAsia Technologies Inc., CN = TrustAsia DV SSL CA - C3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                11:EF:03:50:4D:26:81:1C:7A:C7:DB:DF:AF:1B:ED:C0:26:04:D6:48
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C25F1E96000BC36E2AA5CD54BF24F48B76890A162E1AD8E104992650510626C2
    SPKI SHA256: 9190F5AC0872754718C7F8878B043EC6C87DDA275CE42AF2BECE3ED8C7909E99
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### TrustAsia DV TLS RSA CA C5

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia DV TLS RSA CA C5
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 62DB2441F12A6415DB34E012E21C2C2C
- SHA-256: 282C0E6401E5C33D1C89F2835FAE01B0F9585C51A71766FDCED3AA5B2222B796
- SPKI SHA-256: C49DB8F4371C523B57F2C9403733B43A668DCAEA3BD4DEF2224A7F2D3334A7BD
- Validity: 2025-01-15 to 2035-01-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://trustasiadvtlsr35g2ca.crl.certum.pl/trustasiadvtlsr35g2ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            62:db:24:41:f1:2a:64:15:db:34:e0:12:e2:1c:2c:2c
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Jan 15 10:28:38 2025 GMT
            Not After : Jan  3 10:28:38 2035 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia DV TLS RSA CA C5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                33:1C:48:4B:CB:BC:C5:32:79:9F:79:C8:09:F3:20:C9:38:5F:4F:43
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 282C0E6401E5C33D1C89F2835FAE01B0F9585C51A71766FDCED3AA5B2222B796
    SPKI SHA256: C49DB8F4371C523B57F2C9403733B43A668DCAEA3BD4DEF2224A7F2D3334A7BD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia EV SSL CA - C3

- Subject: countryName=CN, organizationName=TrustAsia Technologies Inc., commonName=TrustAsia EV SSL CA - C3
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 178666A8554ACCBFE73457E6451A686C
- SHA-256: BC0878CBBC4E0DAF7A9DA464AB16262A235BFDAED33B9F9569BA18FF34997580
- SPKI SHA-256: DF3BE1AFD14BA31FFA1CAF822EF47FC04E172908EDA83BF334FC52AF433C8DE6
- Validity: 2017-10-23 to 2027-05-14
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://trustasiaev.crl.certum.pl/trustasiaev.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            17:86:66:a8:55:4a:cc:bf:e7:34:57:e6:45:1a:68:6c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Oct 23 07:22:36 2017 GMT
            Not After : May 14 07:22:36 2027 GMT
        Subject: C = CN, O = TrustAsia Technologies Inc., CN = TrustAsia EV SSL CA - C3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                61:16:6D:99:C5:42:F4:93:01:99:07:CE:91:A7:7E:C6:AC:4C:FC:33
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BC0878CBBC4E0DAF7A9DA464AB16262A235BFDAED33B9F9569BA18FF34997580
    SPKI SHA256: DF3BE1AFD14BA31FFA1CAF822EF47FC04E172908EDA83BF334FC52AF433C8DE6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### TrustAsia EV TLS ECC CA C5

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS ECC CA C5
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum EC-384 CA
- Serial: C4B6DD589D238FC80F7F60FBD6A68827
- SHA-256: 3ACC4CAD7718C2E5BF549BFE1DAB9234B2EB71C00E72A554759745A611D81774
- SPKI SHA-256: 0B591CE512C3954332BA3B61C1167DD835221ACFCB12FCFB515ED45F3D5A5146
- Validity: 2025-01-15 to 2035-01-03
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://trustasiaevtlse35g2ca.crl.certum.pl/trustasiaevtlse35g2ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c4:b6:dd:58:9d:23:8f:c8:0f:7f:60:fb:d6:a6:88:27
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum EC-384 CA
        Validity
            Not Before: Jan 15 10:39:07 2025 GMT
            Not After : Jan  3 10:39:07 2035 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia EV TLS ECC CA C5
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/cec384ca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8D:06:66:74:24:76:3A:F3:89:F7:BC:D6:BD:47:7D:2F:BC:10:5F:4B
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/cec384ca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                EE:39:AA:15:43:E7:5A:C5:47:F1:CA:73:0B:35:3B:16:83:5B:72:3D
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 3ACC4CAD7718C2E5BF549BFE1DAB9234B2EB71C00E72A554759745A611D81774
    SPKI SHA256: 0B591CE512C3954332BA3B61C1167DD835221ACFCB12FCFB515ED45F3D5A5146
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/cec384ca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia EV TLS RSA CA C5

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS RSA CA C5
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 2A26E431FF549D133FAED1B1811F713F
- SHA-256: A18CBF79E904E3BCC9D74D5ED062A46A90E2C7D89904114EC38B18650CD83E2C
- SPKI SHA-256: A8529CCA7C586A5923AE964D44F6167BB7E8055086A05FFDA18F3FAD3C6400B3
- Validity: 2025-01-15 to 2035-01-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://trustasiaevtlsr35g2ca.crl.certum.pl/trustasiaevtlsr35g2ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2a:26:e4:31:ff:54:9d:13:3f:ae:d1:b1:81:1f:71:3f
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Jan 15 10:31:05 2025 GMT
            Not After : Jan  3 10:31:05 2035 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia EV TLS RSA CA C5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                7E:3A:01:29:DB:C1:E9:54:B0:76:60:42:AC:F6:FC:C7:9F:7B:A2:A5
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: A18CBF79E904E3BCC9D74D5ED062A46A90E2C7D89904114EC38B18650CD83E2C
    SPKI SHA256: A8529CCA7C586A5923AE964D44F6167BB7E8055086A05FFDA18F3FAD3C6400B3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia OV SSL CA - C3

- Subject: countryName=CN, organizationName=TrustAsia Technologies Inc., commonName=TrustAsia OV SSL CA - C3
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 309E97B6CCD8672842FA2059592920A8
- SHA-256: 7A142B1A5E16215183A13E840A862A437E293D9366921DB07EDB54F138AC0D78
- SPKI SHA-256: 8446516F46817F287FD72A22EC82369B44D0FC90A42605B07CB6678BB9595076
- Validity: 2017-10-23 to 2027-05-14
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://trustasiaov.crl.certum.pl/trustasiaov.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            30:9e:97:b6:cc:d8:67:28:42:fa:20:59:59:29:20:a8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Oct 23 07:20:14 2017 GMT
            Not After : May 14 07:20:14 2027 GMT
        Subject: C = CN, O = TrustAsia Technologies Inc., CN = TrustAsia OV SSL CA - C3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                86:67:A7:6C:80:64:32:21:F5:20:5C:FD:02:0C:D7:DE:1D:87:98:62
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7A142B1A5E16215183A13E840A862A437E293D9366921DB07EDB54F138AC0D78
    SPKI SHA256: 8446516F46817F287FD72A22EC82369B44D0FC90A42605B07CB6678BB9595076
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### TrustAsia OV TLS ECC CA C5

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia OV TLS ECC CA C5
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum EC-384 CA
- Serial: 3DE6F5C069A24A46BA47B2EFED2BD8CE
- SHA-256: C66497D671E53EE16A3D90A65C24A06FD7C0465E4DCFD4F8EF86B6CC75FC7760
- SPKI SHA-256: 420617D304A0EFA686265C66BABB4B9AF3A214532226BEF5F7CE29166EEF82F0
- Validity: 2025-01-15 to 2035-01-03
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://trustasiaovtlse35g2ca.crl.certum.pl/trustasiaovtlse35g2ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3d:e6:f5:c0:69:a2:4a:46:ba:47:b2:ef:ed:2b:d8:ce
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum EC-384 CA
        Validity
            Not Before: Jan 15 10:37:58 2025 GMT
            Not After : Jan  3 10:37:58 2035 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia OV TLS ECC CA C5
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/cec384ca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8D:06:66:74:24:76:3A:F3:89:F7:BC:D6:BD:47:7D:2F:BC:10:5F:4B
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/cec384ca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                9C:F2:CB:25:DF:12:23:55:4B:4C:EB:C7:5E:86:8A:12:79:A8:EA:01
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C66497D671E53EE16A3D90A65C24A06FD7C0465E4DCFD4F8EF86B6CC75FC7760
    SPKI SHA256: 420617D304A0EFA686265C66BABB4B9AF3A214532226BEF5F7CE29166EEF82F0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/cec384ca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia OV TLS RSA CA C5

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia OV TLS RSA CA C5
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: EFC7C750C7DDE552570AC78B9FCE1EED
- SHA-256: ABF95652710CE99ECFBCBDAFCDCA81F3865BA1F88161ADA61090E502A6B1667E
- SPKI SHA-256: FB6ECAC6518CA0762A9B8079C9B534D9F833647BEACEAAFE131CC3E6C7B20206
- Validity: 2025-01-15 to 2035-01-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://trustasiaovtlsr35g2ca.crl.certum.pl/trustasiaovtlsr35g2ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ef:c7:c7:50:c7:dd:e5:52:57:0a:c7:8b:9f:ce:1e:ed
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Jan 15 10:29:55 2025 GMT
            Not After : Jan  3 10:29:55 2035 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia OV TLS RSA CA C5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                32:1E:CA:30:76:25:57:52:D3:9D:74:EF:7F:8C:81:E0:E5:A4:51:61
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: ABF95652710CE99ECFBCBDAFCDCA81F3865BA1F88161ADA61090E502A6B1667E
    SPKI SHA256: FB6ECAC6518CA0762A9B8079C9B534D9F833647BEACEAAFE131CC3E6C7B20206
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia SMIME CA 2025

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia SMIME CA 2025
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 2E8B1C6883532694EFE243A3F83335
- SHA-256: E802A9679975DAD283EC482666D82A7CE54E1086873510F5A4CC49BD913CECAC
- SPKI SHA-256: DF2ABCE8C5B55F1E2EF1EDD6E67FE3F89A9412BBD27F2DD083E9802EFE714DDE
- Validity: 2025-01-15 to 2035-01-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://trustasiasmimer35g2ca.crl.certum.pl/trustasiasmimer35g2ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2e:8b:1c:68:83:53:26:94:ef:e2:43:a3:f8:33:35
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Jan 15 10:31:59 2025 GMT
            Not After : Jan  3 10:31:59 2035 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia SMIME CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                15:19:95:DD:37:2B:19:37:3D:EC:85:3D:B9:22:D9:80:8D:3D:60:9C
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: E802A9679975DAD283EC482666D82A7CE54E1086873510F5A4CC49BD913CECAC
    SPKI SHA256: DF2ABCE8C5B55F1E2EF1EDD6E67FE3F89A9412BBD27F2DD083E9802EFE714DDE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia TLS ECC Root CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: C64E96CEA27ADDBCCE6E566E52546349
- SHA-256: FBE52F7D83E613D166F592A9227B08A9235E3DAA875FBA2ACD10A8C0D220DA2F
- SPKI SHA-256: F4632E58701C0BD7DAFC7E3831355EC433FC13777DE286683E8EC50964DF0452
- Validity: 2025-10-07 to 2029-01-14
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: TrustAsia Technologies, Inc.
- CP/CPS: https://repository.trustasia.com/repo/cps/TrustAsia-Global-CP-CPS_EN_V2.1.3.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=232d854a-3ab9-45f9-b85d-21b0e9221e14, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=502c0aa5-0649-452f-ab45-eea59a6a07cd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=76914bf6-9b3a-4c5f-b739-419a1152c6ca, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=411bce13-7fd2-46bf-a31b-b3cec80e9ff9
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaTLSECCRootCA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 2
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.1, 1.3.6.1.4.1.44494.2.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://certum-crl.wt.trustasia.com/ctnca.crl, http://trustasia.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c6:4e:96:ce:a2:7a:dd:bc:ce:6e:56:6e:52:54:63:49
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Oct  7 06:59:26 2025 GMT
            Not After : Jan 14 06:59:26 2029 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS ECC Root CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://trustasia.repository.certum.pl/ctnca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://certum-crl.wt.trustasia.com/ctnca.crl
                Full Name:
                  URI:http://trustasia.crl.certum.pl/ctnca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.44494.2.1.1
            X509v3 Subject Key Identifier:
                2C:85:53:BB:B1:43:CD:32:EA:9E:A3:87:FE:A2:98:A8:A6:93:E9:10
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: FBE52F7D83E613D166F592A9227B08A9235E3DAA875FBA2ACD10A8C0D220DA2F
    SPKI SHA256: F4632E58701C0BD7DAFC7E3831355EC433FC13777DE286683E8EC50964DF0452
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":2}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.1, 1.3.6.1.4.1.44494.2.1.1
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://trustasia.repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://certum-crl.wt.trustasia.com/ctnca.crl, http://trustasia.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier
- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia TLS RSA Root CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: B2DC4C34932D709CD4BF0B099401695C
- SHA-256: CE0DF856EA6CC0EBE068F55C4CC4DE77DEF45CACB2D4E946D8ADE706666F5887
- SPKI SHA-256: 5628872E245FE66148B80BADEAC9C40F6252E642FA9595AECE4B3E8A58B8FD46
- Validity: 2025-10-07 to 2029-01-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: TrustAsia Technologies, Inc.
- CP/CPS: https://repository.trustasia.com/repo/cps/TrustAsia-Global-CP-CPS_EN_V2.1.3.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=232d854a-3ab9-45f9-b85d-21b0e9221e14, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=502c0aa5-0649-452f-ab45-eea59a6a07cd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=76914bf6-9b3a-4c5f-b739-419a1152c6ca, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=411bce13-7fd2-46bf-a31b-b3cec80e9ff9
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaTLSRSARootCA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 2
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.1, 1.3.6.1.4.1.44494.2.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://certum-crl.wt.trustasia.com/ctnca.crl, http://trustasia.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b2:dc:4c:34:93:2d:70:9c:d4:bf:0b:09:94:01:69:5c
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Oct  7 06:57:08 2025 GMT
            Not After : Jan 14 06:57:08 2029 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS RSA Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://trustasia.repository.certum.pl/ctnca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://certum-crl.wt.trustasia.com/ctnca.crl
                Full Name:
                  URI:http://trustasia.crl.certum.pl/ctnca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.44494.2.1.1
            X509v3 Subject Key Identifier:
                B8:07:91:79:5C:06:F4:46:FD:7B:59:CA:5A:26:91:A7:45:2B:F8:53
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: CE0DF856EA6CC0EBE068F55C4CC4DE77DEF45CACB2D4E946D8ADE706666F5887
    SPKI SHA256: 5628872E245FE66148B80BADEAC9C40F6252E642FA9595AECE4B3E8A58B8FD46
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":2}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.1, 1.3.6.1.4.1.44494.2.1.1
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://trustasia.repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://certum-crl.wt.trustasia.com/ctnca.crl, http://trustasia.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustgate SMIME G2 E31 CA

- Subject: countryName=MY, organizationName=MSC Trustgate.com Sdn. Bhd., commonName=Trustgate SMIME G2 E31 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum EC-384 CA
- Serial: 49A1E62F0D25800BCE9E50A0E300EDB9
- SHA-256: 749D9CDF01084CB5DA49DDEF11E193ECFA6530E67419302C4D945BAF74342145
- SPKI SHA-256: 12C093603550F07DFF9934CDD2DF4C46B68EEF89F40DF7E68842DCCF49BC25C6
- Validity: 2026-05-27 to 2031-05-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://trustgatesmimeg2e31ca.crl.certum.pl/trustgatesmimeg2e31ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            49:a1:e6:2f:0d:25:80:0b:ce:9e:50:a0:e3:00:ed:b9
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum EC-384 CA
        Validity
            Not Before: May 27 07:33:55 2026 GMT
            Not After : May 16 07:33:55 2031 GMT
        Subject: C = MY, O = MSC Trustgate.com Sdn. Bhd., CN = Trustgate SMIME G2 E31 CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/cec384ca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8D:06:66:74:24:76:3A:F3:89:F7:BC:D6:BD:47:7D:2F:BC:10:5F:4B
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/cec384ca.crl
            X509v3 Extended Key Usage:
                E-mail Protection, TLS Web Client Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                F8:03:9E:2B:02:40:7A:C1:A2:5C:72:A5:A8:F2:3A:22:03:5A:AA:EA
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 749D9CDF01084CB5DA49DDEF11E193ECFA6530E67419302C4D945BAF74342145
    SPKI SHA256: 12C093603550F07DFF9934CDD2DF4C46B68EEF89F40DF7E68842DCCF49BC25C6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/cec384ca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustOcean Certification Authority

- Subject: countryName=CN, organizationName=QiaoKr Corporation Limited, commonName=TrustOcean Certification Authority
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 1509B3B352D6689B5A7272F372E7E028
- SHA-256: A416A2BA490C454E23B85BF087DB7B137F4F47D9747E60F8692FF4C8DF0E062B
- SPKI SHA-256: 02A9F195518772E132C01750C6770EA0C05DDB0FA274D95FA031274E0131E52E
- Validity: 2017-10-23 to 2027-05-14
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://trustocean.crl.certum.pl/trustocean.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            15:09:b3:b3:52:d6:68:9b:5a:72:72:f3:72:e7:e0:28
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Oct 23 07:26:08 2017 GMT
            Not After : May 14 07:26:08 2027 GMT
        Subject: C = CN, O = QiaoKr Corporation Limited, CN = TrustOcean Certification Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                43:E1:4C:C7:3A:02:AF:2B:EC:27:F5:B5:70:85:B4:82:A4:D0:B1:9F
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A416A2BA490C454E23B85BF087DB7B137F4F47D9747E60F8692FF4C8DF0E062B
    SPKI SHA256: 02A9F195518772E132C01750C6770EA0C05DDB0FA274D95FA031274E0131E52E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### UCA Global G2 Root

- Subject: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 1D8A6FC17A0C81BCA26C435AEFA50078
- SHA-256: BB61408AED9F530B2EC0545E53BA2C8EBEAA57D9976447DB1663CED4600CD6B7
- SPKI SHA-256: 1255CABE8152FA64DF942F7A47417E29F96C1CE11BF8C84ECBE2815CC1280810
- Validity: 2024-01-08 to 2029-01-06
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Shanghai Electronic Certification Authority Co., Ltd.
- CP/CPS: https://assets-cdn.sheca.com/documents/CP-CPS-TLS-v1.4.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=24fb8c97-6794-4ea5-9edf-08bf1d9dfb94, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1f1ac968-90bb-425a-a8d4-9145ce4fbe85, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f53cdfff-2713-4ae6-9911-188399a81304, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1fe4900e-4628-4179-84fe-03cc0ed9698f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=182b8855-b43b-49b3-bde1-74cd62e1a554, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=97e2e70c-8858-48f2-86db-3512a420cd88
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/root/globalg2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://certum.crl.sheca.com/ctnca.crl, http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1d:8a:6f:c1:7a:0c:81:bc:a2:6c:43:5a:ef:a5:00:78
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Jan  8 11:07:19 2024 GMT
            Not After : Jan  6 11:07:19 2029 GMT
        Subject: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://certum.crl.sheca.com/ctnca.crl
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BB61408AED9F530B2EC0545E53BA2C8EBEAA57D9976447DB1663CED4600CD6B7
    SPKI SHA256: 1255CABE8152FA64DF942F7A47417E29F96C1CE11BF8C84ECBE2815CC1280810
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://certum.crl.sheca.com/ctnca.crl, http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### UCA Global G2 Root

- Subject: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: BCAFE9189509E612F8252B74C0398792
- SHA-256: BFA95C5DF164B659FA32F6D10564D7170DDE661A853A782E6AB63639433BCB41
- SPKI SHA-256: 1255CABE8152FA64DF942F7A47417E29F96C1CE11BF8C84ECBE2815CC1280810
- Validity: 2024-01-08 to 2029-01-06
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Shanghai Electronic Certification Authority Co., Ltd.
- CP/CPS: https://assets-cdn.sheca.com/documents/CP-CPS-TLS-v1.4.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=24fb8c97-6794-4ea5-9edf-08bf1d9dfb94, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1f1ac968-90bb-425a-a8d4-9145ce4fbe85, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f53cdfff-2713-4ae6-9911-188399a81304, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1fe4900e-4628-4179-84fe-03cc0ed9698f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=182b8855-b43b-49b3-bde1-74cd62e1a554, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=97e2e70c-8858-48f2-86db-3512a420cd88
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/root/globalg2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://certum.crl.sheca.com/ctnca.crl, http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            bc:af:e9:18:95:09:e6:12:f8:25:2b:74:c0:39:87:92
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Jan  8 11:05:41 2024 GMT
            Not After : Jan  6 11:05:41 2029 GMT
        Subject: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://certum.crl.sheca.com/ctnca.crl
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BFA95C5DF164B659FA32F6D10564D7170DDE661A853A782E6AB63639433BCB41
    SPKI SHA256: 1255CABE8152FA64DF942F7A47417E29F96C1CE11BF8C84ECBE2815CC1280810
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://certum.crl.sheca.com/ctnca.crl, http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### UCA Global G2 Root

- Subject: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: BB022BF9AB4BF20BF4ED2016DA849FBE
- SHA-256: C1AFC65B1E813B0E6146E6AA5341681272ABE9A38D59F7BD1B27B729834A0D9C
- SPKI SHA-256: 1255CABE8152FA64DF942F7A47417E29F96C1CE11BF8C84ECBE2815CC1280810
- Validity: 2020-02-21 to 2025-02-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Shanghai Electronic Certification Authority Co., Ltd.
- CP/CPS: https://assets-cdn.sheca.com/documents/UniTrust%20Certificate%20Policy%20v1.5.1%EF%BC%88EN%20)%20%20.pdf, https://assets-cdn.sheca.com/documents/UniTrust%20Certification%20Practice%20Statement%20v3.7.3%EF%BC%88EN%EF%BC%89.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=aec0f290-c328-4680-aa32-b9940b2efddd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2864cf32-d9e2-4707-9b59-3690fa197ada, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=adab9973-2cd3-418c-867b-bc9f1b7130a5
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/root/globalg2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://certum.crl.sheca.com/ctnca.crl, http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            bb:02:2b:f9:ab:4b:f2:0b:f4:ed:20:16:da:84:9f:be
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Feb 21 09:15:50 2020 GMT
            Not After : Feb 21 09:15:50 2025 GMT
        Subject: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://certum.crl.sheca.com/ctnca.crl
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C1AFC65B1E813B0E6146E6AA5341681272ABE9A38D59F7BD1B27B729834A0D9C
    SPKI SHA256: 1255CABE8152FA64DF942F7A47417E29F96C1CE11BF8C84ECBE2815CC1280810
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://certum.crl.sheca.com/ctnca.crl, http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### UCA Global G2 Root

- Subject: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: E5E470E83BF9A012394C7313ACA25593
- SHA-256: 3DD69C5BE170F943F804D1D31FE8F916C0C0226CDDD7AEA9AA9A0CDFD3474361
- SPKI SHA-256: 1255CABE8152FA64DF942F7A47417E29F96C1CE11BF8C84ECBE2815CC1280810
- Validity: 2023-03-28 to 2025-02-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Shanghai Electronic Certification Authority Co., Ltd.
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=19c9c7f1-f266-4590-af26-5dd966d42501, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1dae9bf9-b4c3-49f1-a5b5-3f38d848bab5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=8fb4576e-f39d-49b3-b4f5-e40e022f1f61, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6f3a3b25-e395-4d37-a246-5577eb4c77dd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=aa03f908-bde8-4967-81da-8c91029f87d9, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c9a45b2a-d5e1-4127-b20a-fce6677ca840
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/root/globalg2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://certum.crl.sheca.com/ctnca.crl, http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            e5:e4:70:e8:3b:f9:a0:12:39:4c:73:13:ac:a2:55:93
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Mar 28 07:42:19 2023 GMT
            Not After : Feb 21 07:42:19 2025 GMT
        Subject: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://certum.crl.sheca.com/ctnca.crl
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3DD69C5BE170F943F804D1D31FE8F916C0C0226CDDD7AEA9AA9A0CDFD3474361
    SPKI SHA256: 1255CABE8152FA64DF942F7A47417E29F96C1CE11BF8C84ECBE2815CC1280810
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://certum.crl.sheca.com/ctnca.crl, http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### United Trust

- Subject: countryName=DE, organizationName=United SSL Deutschland GmbH, commonName=United Trust
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 4BE92A902784951DC13AC6CE37D230FE
- SHA-256: 68FC6237C4B8722A1BDFB9583F728840A18BFCC3D6C6E1D6B0A307624577DBD0
- SPKI SHA-256: 5D9BB6215EC56915549D083362FC48460EE7033BB10D831C7CC233F063952D37
- Validity: 2021-02-24 to 2027-05-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://unitedtrustov.crl.certum.pl/unitedtrustov.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4b:e9:2a:90:27:84:95:1d:c1:3a:c6:ce:37:d2:30:fe
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Feb 24 09:00:24 2021 GMT
            Not After : May 31 09:00:24 2027 GMT
        Subject: C = DE, O = United SSL Deutschland GmbH, CN = United Trust
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EE:77:78:BA:00:1D:F3:D8:9C:92:90:6D:BA:92:E5:22:B7:53:42:99
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 68FC6237C4B8722A1BDFB9583F728840A18BFCC3D6C6E1D6B0A307624577DBD0
    SPKI SHA256: 5D9BB6215EC56915549D083362FC48460EE7033BB10D831C7CC233F063952D37
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### vTrus DV SSL CA G1

- Subject: countryName=CN, organizationName=iTrusChina Co., Ltd., commonName=vTrus DV SSL CA G1
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: CB046B5804E8F3DA024BCFEC24410D08
- SHA-256: A5764DFD0454AD3A06428B907DB8AA436DA6317209EAFD61DD42E56AE77F9B13
- SPKI SHA-256: 2E1E43978AEB66C7CC40CF50F54D8172610A001830DCDCD4E68992F876FB8FE1
- Validity: 2019-12-20 to 2024-12-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/itrusdv.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            cb:04:6b:58:04:e8:f3:da:02:4b:cf:ec:24:41:0d:08
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Dec 20 11:28:31 2019 GMT
            Not After : Dec 20 11:28:31 2024 GMT
        Subject: C = CN, O = "iTrusChina Co., Ltd.", CN = vTrus DV SSL CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                62:74:1D:64:6D:80:94:D6:DA:C3:82:5F:A2:97:F6:30:7F:E5:C4:C9
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A5764DFD0454AD3A06428B907DB8AA436DA6317209EAFD61DD42E56AE77F9B13
    SPKI SHA256: 2E1E43978AEB66C7CC40CF50F54D8172610A001830DCDCD4E68992F876FB8FE1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### vTrus DV SSL CA G2

- Subject: countryName=CN, organizationName=iTrusChina Co., Ltd., commonName=vTrus DV SSL CA G2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: E9817656FCFF3EBE0FF6F9FCCB37B592
- SHA-256: D7A43AAB5B59F58CB68CC01CF838A392EE913FF330FE7C3309EDA30B84541D07
- SPKI SHA-256: EBF2400C68084BBAA72F7AB91E34A84CECDCDE874C3628DC9AEAEC32726145E4
- Validity: 2023-12-07 to 2027-05-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://itrusdv2.crl.certum.pl/itrusdv2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            e9:81:76:56:fc:ff:3e:be:0f:f6:f9:fc:cb:37:b5:92
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Dec  7 09:50:53 2023 GMT
            Not After : May 25 09:50:53 2027 GMT
        Subject: C = CN, O = "iTrusChina Co., Ltd.", CN = vTrus DV SSL CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4A:5F:C3:B3:55:15:AE:2C:4D:5C:AF:D5:98:C9:BC:9D:86:13:26:E2
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D7A43AAB5B59F58CB68CC01CF838A392EE913FF330FE7C3309EDA30B84541D07
    SPKI SHA256: EBF2400C68084BBAA72F7AB91E34A84CECDCDE874C3628DC9AEAEC32726145E4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### vTrus OV SSL CA G1

- Subject: countryName=CN, organizationName=iTrusChina Co., Ltd., commonName=vTrus OV SSL CA G1
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: B8F9924FEEDB725003E015CF689F8BF6
- SHA-256: DAFD2506A7E917C126E5904479439D7795087F04FA7BBE614796727B9A161D6F
- SPKI SHA-256: 8896181C48D835C7037FB978AD9AADF3FE83742EF6F31CB8C7C45C40D3B26B7A
- Validity: 2019-12-20 to 2024-12-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/itrusov.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b8:f9:92:4f:ee:db:72:50:03:e0:15:cf:68:9f:8b:f6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Dec 20 11:29:10 2019 GMT
            Not After : Dec 20 11:29:10 2024 GMT
        Subject: C = CN, O = "iTrusChina Co., Ltd.", CN = vTrus OV SSL CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                6B:55:C9:82:20:73:E0:35:25:24:E1:48:57:54:B0:79:25:4B:79:A4
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DAFD2506A7E917C126E5904479439D7795087F04FA7BBE614796727B9A161D6F
    SPKI SHA256: 8896181C48D835C7037FB978AD9AADF3FE83742EF6F31CB8C7C45C40D3B26B7A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### vTrus OV SSL CA G2

- Subject: countryName=CN, organizationName=iTrusChina Co., Ltd., commonName=vTrus OV SSL CA G2
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 61EF741269E462001863A280073DFC45
- SHA-256: 3296EB060C887E8EC0E59903E9CC8D5F6302EE8FABA95620AE5DE2364333F753
- SPKI SHA-256: 33F4FE383972EF37DD17FADE82A54F502339D80611DA7009497D9815EFE07835
- Validity: 2023-12-07 to 2027-05-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://itrusov2.crl.certum.pl/itrusov2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:ef:74:12:69:e4:62:00:18:63:a2:80:07:3d:fc:45
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Dec  7 09:52:05 2023 GMT
            Not After : May 25 09:52:05 2027 GMT
        Subject: C = CN, O = "iTrusChina Co., Ltd.", CN = vTrus OV SSL CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5F:4C:6A:83:9F:36:AE:1D:2B:E5:46:59:CD:C9:2C:39:5F:62:D6:59
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3296EB060C887E8EC0E59903E9CC8D5F6302EE8FABA95620AE5DE2364333F753
    SPKI SHA256: 33F4FE383972EF37DD17FADE82A54F502339D80611DA7009497D9815EFE07835
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### WhiteSSL DV TLS G2 E36 CA

- Subject: countryName=US, organizationName=WhiteSSL, LLC, commonName=WhiteSSL DV TLS G2 E36 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum EC-384 CA
- Serial: 839CA9953BCE17DB9AF769D9BAFBB01F
- SHA-256: 436E0B7A910D045E7D87A00A320D66D7A4935D3C25EE906CA69CED227AB2CBF5
- SPKI SHA-256: 804DEF964C617AEB7B34A53C57ABF8E92EFDED5AC6ECC16076FF07D7B4353083
- Validity: 2026-01-14 to 2036-01-02
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://whitessldvtlsg2e36ca.crl.certum.pl/whitessldvtlsg2e36ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:9c:a9:95:3b:ce:17:db:9a:f7:69:d9:ba:fb:b0:1f
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum EC-384 CA
        Validity
            Not Before: Jan 14 09:00:48 2026 GMT
            Not After : Jan  2 09:00:48 2036 GMT
        Subject: C = US, O = "WhiteSSL, LLC", CN = WhiteSSL DV TLS G2 E36 CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/cec384ca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8D:06:66:74:24:76:3A:F3:89:F7:BC:D6:BD:47:7D:2F:BC:10:5F:4B
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/cec384ca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                C2:BA:30:22:D0:30:CA:06:52:6F:38:CB:21:6C:50:EA:6C:1D:E7:65
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 436E0B7A910D045E7D87A00A320D66D7A4935D3C25EE906CA69CED227AB2CBF5
    SPKI SHA256: 804DEF964C617AEB7B34A53C57ABF8E92EFDED5AC6ECC16076FF07D7B4353083
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/cec384ca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/cec384ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### WoSign Code Signing CA

- Subject: countryName=CN, organizationName=WoSign CA Limited, commonName=WoSign Code Signing CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 17EF72B4157D6F4B68E4BDD575E5CCAE
- SHA-256: 7B0BC3563D43309118F560A6C99A221C35399B10293F73BE41A12ACA0338075F
- SPKI SHA-256: 1594B417FFC9EC51F3A4DAAFDB67E14D96759ECF258AFA846A207D35FB5D8A85
- Validity: 2016-11-09 to 2026-11-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://wosign.crl.certum.pl/wosign-csca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            17:ef:72:b4:15:7d:6f:4b:68:e4:bd:d5:75:e5:cc:ae
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Nov  9 08:45:13 2016 GMT
            Not After : Nov  9 08:45:13 2026 GMT
        Subject: C = CN, O = WoSign CA Limited, CN = WoSign Code Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                83:D1:49:9C:55:28:59:37:A9:7E:40:83:EC:CD:A2:46:54:05:3C:A2
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7B0BC3563D43309118F560A6C99A221C35399B10293F73BE41A12ACA0338075F
    SPKI SHA256: 1594B417FFC9EC51F3A4DAAFDB67E14D96759ECF258AFA846A207D35FB5D8A85
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### WoSign DV SSL CA

- Subject: countryName=CN, organizationName=WoSign CA Limited, commonName=WoSign DV SSL CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: E21A211AA891E2D35459FFD36D27C426
- SHA-256: 0330286DF3612C0E968DCD518A7A316D5E0790D1CA324B906B0EF017C0BE3EA7
- SPKI SHA-256: 1BF57EE00608F57024363764E1266A2EB5A4CA57D96E03C6D52E1C367014D45E
- Validity: 2017-05-18 to 2027-05-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://wosign.crl.certum.pl/wosign-dvca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            e2:1a:21:1a:a8:91:e2:d3:54:59:ff:d3:6d:27:c4:26
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: May 18 07:46:14 2017 GMT
            Not After : May 18 07:46:14 2027 GMT
        Subject: C = CN, O = WoSign CA Limited, CN = WoSign DV SSL CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CA:9B:8D:2E:44:50:42:8A:D9:02:65:32:1A:9E:80:F3:88:04:2A:B5
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0330286DF3612C0E968DCD518A7A316D5E0790D1CA324B906B0EF017C0BE3EA7
    SPKI SHA256: 1BF57EE00608F57024363764E1266A2EB5A4CA57D96E03C6D52E1C367014D45E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### WoSign EV SSL CA

- Subject: countryName=CN, organizationName=WoSign CA Limited, commonName=WoSign EV SSL CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 520A3A469D146B20297AFD015E64ABF5
- SHA-256: C0AB07D9071A4CC1D34409178F8BCA058310A8B111DDCFA655658760226F50F9
- SPKI SHA-256: 914B1AA8415C44D61E2CC0DA2924FCDA308AD9F3F6433483454C8DF768A272FC
- Validity: 2016-11-10 to 2026-11-10
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://wosign.crl.certum.pl/wosign-evca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:0a:3a:46:9d:14:6b:20:29:7a:fd:01:5e:64:ab:f5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Nov 10 11:03:19 2016 GMT
            Not After : Nov 10 11:03:19 2026 GMT
        Subject: C = CN, O = WoSign CA Limited, CN = WoSign EV SSL CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DE:97:08:59:BF:94:69:1D:25:68:DC:EC:76:D0:26:7A:4C:97:FB:1A
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C0AB07D9071A4CC1D34409178F8BCA058310A8B111DDCFA655658760226F50F9
    SPKI SHA256: 914B1AA8415C44D61E2CC0DA2924FCDA308AD9F3F6433483454C8DF768A272FC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### WoSign OV SSL CA

- Subject: countryName=CN, organizationName=WoSign CA Limited, commonName=WoSign OV SSL CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: EF051A741A1D9409FCA5E4640F8D3C9B
- SHA-256: C7F546F0C76C9A0DA9992E9884E6248B7CA2BB6ADE838BD7A03A8C41EE2A3064
- SPKI SHA-256: 319283D9CEB4147101A23FAE64D95E8329481AF09A7EED2D059D9E5076A8D3ED
- Validity: 2016-11-09 to 2026-11-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://wosign.crl.certum.pl/wosign-ovca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ef:05:1a:74:1a:1d:94:09:fc:a5:e4:64:0f:8d:3c:9b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Nov  9 08:33:44 2016 GMT
            Not After : Nov  9 08:33:44 2026 GMT
        Subject: C = CN, O = WoSign CA Limited, CN = WoSign OV SSL CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A1:13:54:DC:56:73:2C:27:82:CA:C8:84:EF:EE:BF:00:FD:5F:AB:56
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C7F546F0C76C9A0DA9992E9884E6248B7CA2BB6ADE838BD7A03A8C41EE2A3064
    SPKI SHA256: 319283D9CEB4147101A23FAE64D95E8329481AF09A7EED2D059D9E5076A8D3ED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### WoTrus Code Signing 2021 CA

- Subject: countryName=CN, organizationName=WoTrus CA Limited, commonName=WoTrus Code Signing 2021 CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA 2
- Serial: 389CD29D8FDBC739F54933BECE9893B4
- SHA-256: 2D687BA569A21640D62F424A999FF36FCAC2203815FCAF5EB0FB77C98C9EC45F
- SPKI SHA-256: 28C16484CECD9716C5C7C9134ADF7EB2DA5363D23DC03839DA3ED7EF3AE67A30
- Validity: 2021-05-26 to 2027-05-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/wotruscsca2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA 2
        Validity
            Not Before: May 26 06:46:35 2021 GMT
            Not After : May 18 06:46:35 2027 GMT
        Subject: C = CN, O = WoTrus CA Limited, CN = WoTrus Code Signing 2021 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                01:7A:87:BC:16:46:8E:79:C8:CC:89:E3:7C:3C:74:8A:70:8F:9A:72
            X509v3 Authority Key Identifier:
                B6:A1:54:39:02:C3:A0:3F:8E:8A:BC:FA:D4:F8:1C:A6:D1:3A:0E:FD
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 2D687BA569A21640D62F424A999FF36FCAC2203815FCAF5EB0FB77C98C9EC45F
    SPKI SHA256: 28C16484CECD9716C5C7C9134ADF7EB2DA5363D23DC03839DA3ED7EF3AE67A30
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca2.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### WoTrus Code Signing CA

- Subject: countryName=CN, organizationName=WoTrus CA Limited, commonName=WoTrus Code Signing CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 6EA1D4945F0E69E9D6F1482C586A71AF
- SHA-256: 0829CAB693AADFAF21C77876DBE76BB9AC7491608FFAEBF7D1D53C289FC88452
- SPKI SHA-256: AC81415641A2B92072515978BEE909CF541CB5864B0632C9F5955AE8DB65DC0F
- Validity: 2018-04-17 to 2027-05-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://wotrus-csca.crl.certum.pl/wotrus-csca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Apr 17 08:20:15 2018 GMT
            Not After : May 18 08:20:15 2027 GMT
        Subject: C = CN, O = WoTrus CA Limited, CN = WoTrus Code Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                26:C6:C1:01:BA:94:F9:B0:1A:81:72:B9:71:E4:EA:3A:98:A9:10:94
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0829CAB693AADFAF21C77876DBE76BB9AC7491608FFAEBF7D1D53C289FC88452
    SPKI SHA256: AC81415641A2B92072515978BEE909CF541CB5864B0632C9F5955AE8DB65DC0F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### WoTrus DV SSL CA

- Subject: countryName=CN, organizationName=WoTrus CA Limited, commonName=WoTrus DV SSL CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 349BB144AE5611E99BF4345C7FC9AEFC
- SHA-256: 6970E396621417DCEE315AAC28BB5EA3161F175020F7F4E9BA17DADE58DBB08D
- SPKI SHA-256: AA8D50CB360250233A4D3A647E5C9695ED8446E350F2AEFFF7DA02B754660E09
- Validity: 2018-04-17 to 2027-05-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://wotrus-dvca.crl.certum.pl/wotrus-dvca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            34:9b:b1:44:ae:56:11:e9:9b:f4:34:5c:7f:c9:ae:fc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Apr 17 08:18:56 2018 GMT
            Not After : May 18 08:18:56 2027 GMT
        Subject: C = CN, O = WoTrus CA Limited, CN = WoTrus DV SSL CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                73:A8:F8:8E:A4:54:4D:81:02:72:1C:4E:C9:B2:A8:C5:34:93:13:6E
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6970E396621417DCEE315AAC28BB5EA3161F175020F7F4E9BA17DADE58DBB08D
    SPKI SHA256: AA8D50CB360250233A4D3A647E5C9695ED8446E350F2AEFFF7DA02B754660E09
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### WoTrus EV SSL CA

- Subject: countryName=CN, organizationName=WoTrus CA Limited, commonName=WoTrus EV SSL CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 07DDED674E2A2C08C9DE6666C971541F
- SHA-256: EA6963696750564A228B3EB88E0FD4304C5DA27A7AF92D1D4199357A50078315
- SPKI SHA-256: 6DF9B7D0ADAE7D00B781020DC65ECEC1112815240426B2B879C303DE3CBF4257
- Validity: 2018-04-17 to 2027-05-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://wotrus-evca.crl.certum.pl/wotrus-evca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:dd:ed:67:4e:2a:2c:08:c9:de:66:66:c9:71:54:1f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Apr 17 08:17:48 2018 GMT
            Not After : May 18 08:17:48 2027 GMT
        Subject: C = CN, O = WoTrus CA Limited, CN = WoTrus EV SSL CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                37:ED:1F:DF:5B:1A:4F:87:25:E0:49:C6:6D:73:02:38:12:48:14:63
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EA6963696750564A228B3EB88E0FD4304C5DA27A7AF92D1D4199357A50078315
    SPKI SHA256: 6DF9B7D0ADAE7D00B781020DC65ECEC1112815240426B2B879C303DE3CBF4257
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### WoTrus OV SSL CA

- Subject: countryName=CN, organizationName=WoTrus CA Limited, commonName=WoTrus OV SSL CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: 05ED88D8088D11EBDDD623963CBAED42
- SHA-256: F6BF88B2A8DCD4FEB4015984EC2F1427C8017D140CF41F22EE689E0D6718012F
- SPKI SHA-256: C710CA27A5ACAC86755FF1355C8D4842050D19CD52AAE4A4E549323811CAAB82
- Validity: 2018-04-17 to 2027-05-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://wotrus-ovca.crl.certum.pl/wotrus-ovca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            05:ed:88:d8:08:8d:11:eb:dd:d6:23:96:3c:ba:ed:42
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Apr 17 08:15:03 2018 GMT
            Not After : May 18 08:15:03 2027 GMT
        Subject: C = CN, O = WoTrus CA Limited, CN = WoTrus OV SSL CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                6A:C0:49:19:52:9F:EA:01:5E:45:0C:B1:F0:0F:7E:A0:5F:6D:8F:E5
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F6BF88B2A8DCD4FEB4015984EC2F1427C8017D140CF41F22EE689E0D6718012F
    SPKI SHA256: C710CA27A5ACAC86755FF1355C8D4842050D19CD52AAE4A4E549323811CAAB82
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### www.lh.pl

- Subject: countryName=PL, organizationName=LH.pl Sp. z o.o., organizationalUnitName=LH.pl, commonName=www.lh.pl
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 0A21D80AF794ED9046816A3C5DB3DD33
- SHA-256: 59A3456E750E325FCB1359DC29E828189B4982C119C64FACFD6728711B30532F
- SPKI SHA-256: 48F7E52533DF6D183A356624C6B39AA96163914CFA77A7F17BC3CE72D3F2105A
- Validity: 2015-01-28 to 2025-01-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/lhsha2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0a:21:d8:0a:f7:94:ed:90:46:81:6a:3c:5d:b3:dd:33
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jan 28 08:58:34 2015 GMT
            Not After : Jan 25 08:58:34 2025 GMT
        Subject: C = PL, O = LH.pl Sp. z o.o., OU = LH.pl, CN = www.lh.pl
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Subject Key Identifier:
                83:6B:0F:87:0F:3F:FF:90:35:1F:8D:13:3E:6F:D3:A5:EB:A6:0C:FC
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 59A3456E750E325FCB1359DC29E828189B4982C119C64FACFD6728711B30532F
    SPKI SHA256: 48F7E52533DF6D183A356624C6B39AA96163914CFA77A7F17BC3CE72D3F2105A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_certificate_policies_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Xcc Trust DV SSL CA

- Subject: countryName=CN, organizationName=Beijing Xinchacha Credit Management Co., Ltd., commonName=Xcc Trust DV SSL CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: C2B755DB93BD472C18D3510BD8EEA0DE
- SHA-256: B81D7010D7E495179BB5BB504223EF2EEF3056557EE3924533718169F1A670C8
- SPKI SHA-256: 0D96B5EE578A4768A8C1BD0B0E2BDD53C4245C2CAE198BFBC3A370F5079020B4
- Validity: 2022-07-01 to 2027-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://xinchacha2dv.crl.certum.pl/xinchacha2dv.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c2:b7:55:db:93:bd:47:2c:18:d3:51:0b:d8:ee:a0:de
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Jul  1 07:51:01 2022 GMT
            Not After : Jun 30 07:51:01 2027 GMT
        Subject: C = CN, O = "Beijing Xinchacha Credit Management Co., Ltd.", CN = Xcc Trust DV SSL CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A1:43:8E:00:34:09:E5:7B:35:33:AE:75:89:04:F2:32:61:0F:A8:E7
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B81D7010D7E495179BB5BB504223EF2EEF3056557EE3924533718169F1A670C8
    SPKI SHA256: 0D96B5EE578A4768A8C1BD0B0E2BDD53C4245C2CAE198BFBC3A370F5079020B4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Xcc Trust OV SSL CA

- Subject: countryName=CN, organizationName=Beijing Xinchacha Credit Management Co., Ltd., commonName=Xcc Trust OV SSL CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: F244082DABA90DA58C72E9F29A9340AE
- SHA-256: 2628D65E94D62E57B6344C31B22920EDA316D9BE68EEF5EACC7362206B7DEAFA
- SPKI SHA-256: A221A35ECBF35208888F3F51DFF9C99A539BD0D6C6364320E695A5DF0CA2F655
- Validity: 2022-07-01 to 2027-06-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://xinchacha2ov.crl.certum.pl/xinchacha2ov.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            f2:44:08:2d:ab:a9:0d:a5:8c:72:e9:f2:9a:93:40:ae
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Jul  1 07:48:47 2022 GMT
            Not After : Jun 30 07:48:47 2027 GMT
        Subject: C = CN, O = "Beijing Xinchacha Credit Management Co., Ltd.", CN = Xcc Trust OV SSL CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FA:A0:CB:C2:C7:5D:81:B5:20:92:07:20:0B:B6:3B:70:3B:09:0E:55
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2628D65E94D62E57B6344C31B22920EDA316D9BE68EEF5EACC7362206B7DEAFA
    SPKI SHA256: A221A35ECBF35208888F3F51DFF9C99A539BD0D6C6364320E695A5DF0CA2F655
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### XinChaCha Trust DV TLS G2 R34 CA

- Subject: countryName=CN, organizationName=Beijing Xinchacha Credit Management Co., Ltd., commonName=XinChaCha Trust DV TLS G2 R34 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 74A2944B333F34FFD1DC8D70D67FC42A
- SHA-256: B5C87A0B2239DAFE0A5285E340626269ACA5E90F57492C38E9050CA5D18BC21A
- SPKI SHA-256: 89ADE303C991CFC01504EE7B8942D7F54DDE1805CAF4ACDA4B2745863915429F
- Validity: 2024-05-28 to 2034-05-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://xinchachatrustdvtlsg2r34ca.crl.certum.pl/xinchachatrustdvtlsg2r34ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            74:a2:94:4b:33:3f:34:ff:d1:dc:8d:70:d6:7f:c4:2a
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: May 28 08:49:52 2024 GMT
            Not After : May 16 08:49:52 2034 GMT
        Subject: C = CN, O = "Beijing Xinchacha Credit Management Co., Ltd.", CN = XinChaCha Trust DV TLS G2 R34 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                4B:01:F8:82:8F:AD:A9:8F:CF:0A:56:30:93:72:48:FE:A4:EE:C1:54
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: B5C87A0B2239DAFE0A5285E340626269ACA5E90F57492C38E9050CA5D18BC21A
    SPKI SHA256: 89ADE303C991CFC01504EE7B8942D7F54DDE1805CAF4ACDA4B2745863915429F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### XinChaCha Trust EV TLS G2 R34 CA

- Subject: countryName=CN, organizationName=Beijing Xinchacha Credit Management Co., Ltd., commonName=XinChaCha Trust EV TLS G2 R34 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 1D4FD446A82B039A251A707472A37BAF
- SHA-256: D79F1F0C8141804B39D04B2592D57AFEBE74F9460654AFF491490DBB7C5A2D74
- SPKI SHA-256: F8D8AB0187A93D8C4820AC84A0D82264DAA197C9E9952CC8D12DE020B3323F8F
- Validity: 2024-05-28 to 2034-05-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://xinchachatrustevtlsg2r34ca.crl.certum.pl/xinchachatrustevtlsg2r34ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1d:4f:d4:46:a8:2b:03:9a:25:1a:70:74:72:a3:7b:af
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: May 28 08:53:54 2024 GMT
            Not After : May 16 08:53:54 2034 GMT
        Subject: C = CN, O = "Beijing Xinchacha Credit Management Co., Ltd.", CN = XinChaCha Trust EV TLS G2 R34 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                65:87:A5:02:F4:7B:5C:C3:5A:72:52:4E:8C:2A:F3:8D:F5:44:A9:A7
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: D79F1F0C8141804B39D04B2592D57AFEBE74F9460654AFF491490DBB7C5A2D74
    SPKI SHA256: F8D8AB0187A93D8C4820AC84A0D82264DAA197C9E9952CC8D12DE020B3323F8F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### XinChaCha Trust OV TLS G2 R34 CA

- Subject: countryName=CN, organizationName=Beijing Xinchacha Credit Management Co., Ltd., commonName=XinChaCha Trust OV TLS G2 R34 CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 0EE662482017DB0CEB556F9B6948D454
- SHA-256: B5D46DC027130E5CED3BE5083EB34028DD9230F4D5A36AD1924D21C0EF984CBA
- SPKI SHA-256: 05363344FACB6E5F5B802D807B307CAFC73A3906CEDB23710169B6C1374770F3
- Validity: 2024-05-28 to 2034-05-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://xinchachatrustovtlsg2r34ca.crl.certum.pl/xinchachatrustovtlsg2r34ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0e:e6:62:48:20:17:db:0c:eb:55:6f:9b:69:48:d4:54
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: May 28 08:52:11 2024 GMT
            Not After : May 16 08:52:11 2034 GMT
        Subject: C = CN, O = "Beijing Xinchacha Credit Management Co., Ltd.", CN = XinChaCha Trust OV TLS G2 R34 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                9A:1D:69:5C:F2:1F:EA:09:47:11:1D:F4:ED:8B:EB:AE:7C:D7:C6:7B
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: B5D46DC027130E5CED3BE5083EB34028DD9230F4D5A36AD1924D21C0EF984CBA
    SPKI SHA256: 05363344FACB6E5F5B802D807B307CAFC73A3906CEDB23710169B6C1374770F3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### XinChaCha Trust SSL Domain Validated

- Subject: countryName=CN, organizationName=Beijing Xinchacha Credit Management Co., Ltd., commonName=XinChaCha Trust SSL Domain Validated
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 56814BE297E30CEB2E65988547AF504A
- SHA-256: 4D45039EECCA114D64822A0AA80944D66E08FAEE62B1D253F140298769F227B4
- SPKI SHA-256: 7762D83F2DB863B24B7CA0CF56497E4316F7C2FC5FF60C31ACBE183189787A70
- Validity: 2020-05-18 to 2025-05-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/xinchachadv.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            56:81:4b:e2:97:e3:0c:eb:2e:65:98:85:47:af:50:4a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: May 18 11:26:21 2020 GMT
            Not After : May 18 11:26:21 2025 GMT
        Subject: C = CN, O = "Beijing Xinchacha Credit Management Co., Ltd.", CN = XinChaCha Trust SSL Domain Validated
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                78:6C:05:C3:6F:01:AD:5C:D7:D2:CE:8A:97:0F:72:E9:06:F2:55:4D
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4D45039EECCA114D64822A0AA80944D66E08FAEE62B1D253F140298769F227B4
    SPKI SHA256: 7762D83F2DB863B24B7CA0CF56497E4316F7C2FC5FF60C31ACBE183189787A70
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### XinChaCha Trust SSL Extended Validated

- Subject: countryName=CN, organizationName=Beijing Xinchacha Credit Management Co., Ltd., commonName=XinChaCha Trust SSL Extended Validated
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 42BE50B1A6753C36409A037888A60EAB
- SHA-256: FE7340370D595A39FFE10DCE2197447CE67C98BE28F0330C8FC85DD03212486D
- SPKI SHA-256: 78C7F237E22483AF5B7A59F8016D4E2156A375BA346CCB52EE39504E37667953
- Validity: 2020-05-18 to 2025-05-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/xinchachaev.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            42:be:50:b1:a6:75:3c:36:40:9a:03:78:88:a6:0e:ab
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: May 18 11:27:33 2020 GMT
            Not After : May 18 11:27:33 2025 GMT
        Subject: C = CN, O = "Beijing Xinchacha Credit Management Co., Ltd.", CN = XinChaCha Trust SSL Extended Validated
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                1E:A4:B2:FD:18:06:AE:3F:3F:CF:FC:8E:38:1B:67:09:74:DC:7D:01
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FE7340370D595A39FFE10DCE2197447CE67C98BE28F0330C8FC85DD03212486D
    SPKI SHA256: 78C7F237E22483AF5B7A59F8016D4E2156A375BA346CCB52EE39504E37667953
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### XinChaCha Trust SSL Organization Validated

- Subject: countryName=CN, organizationName=Beijing Xinchacha Credit Management Co., Ltd., commonName=XinChaCha Trust SSL Organization Validated
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 0A05471BA855D169CF84F3366CEB09EC
- SHA-256: 8E2D07BFC591B14FA314686E1CC8D9BB5F6F8D091C0595194AA2C7585B991887
- SPKI SHA-256: 447A8D68AABEEC685F03137C8BB4F5D272D2AEBE8440298F90F7D1BE75C0D92D
- Validity: 2020-05-18 to 2025-05-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/xinchachaov.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0a:05:47:1b:a8:55:d1:69:cf:84:f3:36:6c:eb:09:ec
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: May 18 11:28:05 2020 GMT
            Not After : May 18 11:28:05 2025 GMT
        Subject: C = CN, O = "Beijing Xinchacha Credit Management Co., Ltd.", CN = XinChaCha Trust SSL Organization Validated
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                20:32:83:BF:97:54:79:11:75:8C:FF:A4:67:30:55:0F:40:E7:D3:C4
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8E2D07BFC591B14FA314686E1CC8D9BB5F6F8D091C0595194AA2C7585B991887
    SPKI SHA256: 447A8D68AABEEC685F03137C8BB4F5D272D2AEBE8440298F90F7D1BE75C0D92D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### XinNet DV TLS CA

- Subject: countryName=CN, organizationName=Xin Net Technology Corp., commonName=XinNet DV TLS CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: 7F575682D641F8B8A78BF887361AD725
- SHA-256: 305EEB4EB23FBCE99276CD08CA51FECCE6E96786C87F5AD84804AAA1F15CF8A5
- SPKI SHA-256: 7B4446858C9DA4F4AE07EB56F7BA4B8E2E09B72C72DD9D3013A699B59148EBAC
- Validity: 2024-12-17 to 2034-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://xinnetdvtlsr34g2ca.crl.certum.pl/xinnetdvtlsr34g2ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:57:56:82:d6:41:f8:b8:a7:8b:f8:87:36:1a:d7:25
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Dec 17 09:57:01 2024 GMT
            Not After : Dec  5 09:57:01 2034 GMT
        Subject: C = CN, O = Xin Net Technology Corp., CN = XinNet DV TLS CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                5F:1A:DF:F3:DC:75:D0:B1:97:39:5C:DA:D5:D3:76:EE:7F:06:0A:03
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 305EEB4EB23FBCE99276CD08CA51FECCE6E96786C87F5AD84804AAA1F15CF8A5
    SPKI SHA256: 7B4446858C9DA4F4AE07EB56F7BA4B8E2E09B72C72DD9D3013A699B59148EBAC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### XinNet EV TLS CA

- Subject: countryName=CN, organizationName=Xin Net Technology Corp., commonName=XinNet EV TLS CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: FB6233E58AEC436769ECFFA78C19DE63
- SHA-256: 44489A469C5CF8B2007E2E58125DDBC24F4186EF3B1C75C2B219DDE6A64FAA7F
- SPKI SHA-256: 36076812275A9C23FC98744962E396D037B3440AB28CC2D8EF6C49204AF8C566
- Validity: 2024-12-17 to 2034-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://xinnetevtlsr34g2ca.crl.certum.pl/xinnetevtlsr34g2ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            fb:62:33:e5:8a:ec:43:67:69:ec:ff:a7:8c:19:de:63
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Dec 17 10:00:13 2024 GMT
            Not After : Dec  5 10:00:13 2034 GMT
        Subject: C = CN, O = Xin Net Technology Corp., CN = XinNet EV TLS CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                B1:D3:AD:C2:99:EA:D9:80:AB:1C:6B:29:FA:0D:18:87:FD:D3:7A:07
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 44489A469C5CF8B2007E2E58125DDBC24F4186EF3B1C75C2B219DDE6A64FAA7F
    SPKI SHA256: 36076812275A9C23FC98744962E396D037B3440AB28CC2D8EF6C49204AF8C566
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### XinNet OV TLS CA

- Subject: countryName=CN, organizationName=Xin Net Technology Corp., commonName=XinNet OV TLS CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: C22898E4722CE45FE5DC3A23A2E9CFAE
- SHA-256: 472CE6D110A5F3C58B6A34F307EFD5AF173402D6E25C109C455EE390A1C6E3C0
- SPKI SHA-256: E9D529DCD164AAAFC852D6C4BBAD4F2762D47D09EE93EE89175336129321BB19
- Validity: 2024-12-17 to 2034-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://xinnetovtlsr34g2ca.crl.certum.pl/xinnetovtlsr34g2ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c2:28:98:e4:72:2c:e4:5f:e5:dc:3a:23:a2:e9:cf:ae
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Dec 17 09:58:51 2024 GMT
            Not After : Dec  5 09:58:51 2034 GMT
        Subject: C = CN, O = Xin Net Technology Corp., CN = XinNet OV TLS CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                88:E8:83:68:86:F1:BC:B0:5B:A1:0F:B5:F0:7B:F3:1D:EC:70:8D:A8
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 472CE6D110A5F3C58B6A34F307EFD5AF173402D6E25C109C455EE390A1C6E3C0
    SPKI SHA256: E9D529DCD164AAAFC852D6C4BBAD4F2762D47D09EE93EE89175336129321BB19
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Yandex CA

- Subject: countryName=RU, organizationName=Yandex LLC, organizationalUnitName=Yandex Certification Authority, commonName=Yandex CA
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Network CA
- Serial: E40547830E0C6452976F7A3549C0DD48
- SHA-256: C333B61638B0315FA801CCE21CC4EA96EF7F65A3999450186A99D19BB20128F7
- SPKI SHA-256: 2CD15EFB2738FCD65B255CA7A7101E01DF9BAD4DC43F019BB7017A55E52323F6
- Validity: 2015-01-21 to 2025-01-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.certum.pl/ycasha2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            e4:05:47:83:0e:0c:64:52:97:6f:7a:35:49:c0:dd:48
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Trusted Network CA
        Validity
            Not Before: Jan 21 12:00:00 2015 GMT
            Not After : Jan 18 12:00:00 2025 GMT
        Subject: C = RU, O = Yandex LLC, OU = Yandex Certification Authority, CN = Yandex CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                37:5C:E3:19:E0:B2:8E:A1:A8:4E:D2:CF:AB:D0:DC:E3:0B:5C:35:4D
            X509v3 Authority Key Identifier:
                08:76:CD:CB:07:FF:24:F6:C5:CD:ED:BB:90:BC:E2:84:37:46:75:F7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.certum.pl/ctnca.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/ctnca.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C333B61638B0315FA801CCE21CC4EA96EF7F65A3999450186A99D19BB20128F7
    SPKI SHA256: 2CD15EFB2738FCD65B255CA7A7101E01DF9BAD4DC43F019BB7017A55E52323F6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/ctnca.cer
- CRL Distribution Points: http://crl.certum.pl/ctnca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Yekta Domain Validated SSL CA 1

- Subject: countryName=IR, organizationName=Pardazeshgaran Shahr Hooshmand Yekta Co., commonName=Yekta Domain Validated SSL CA 1
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 2635B3CEFEFD15D42B22486C70946AA8
- SHA-256: 3818995B28A090D83A61667117D50C77C1F1DC7A137680F2E55CE755314F2D0A
- SPKI SHA-256: 1FD11639698F9500C307001BA7FDF54F6C439E4E7197FB69A46728F49A7478E9
- Validity: 2021-01-20 to 2027-05-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://yektadv.crl.certum.pl/yektadv.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            26:35:b3:ce:fe:fd:15:d4:2b:22:48:6c:70:94:6a:a8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jan 20 10:20:40 2021 GMT
            Not After : May 31 10:20:40 2027 GMT
        Subject: C = IR, O = Pardazeshgaran Shahr Hooshmand Yekta Co., CN = Yekta Domain Validated SSL CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AD:55:6F:E9:50:38:76:CC:B9:7A:EB:7A:6C:6C:22:6B:81:B1:06:1C
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3818995B28A090D83A61667117D50C77C1F1DC7A137680F2E55CE755314F2D0A
    SPKI SHA256: 1FD11639698F9500C307001BA7FDF54F6C439E4E7197FB69A46728F49A7478E9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Yekta Organization Validated SSL CA 1

- Subject: countryName=IR, organizationName=Pardazeshgaran Shahr Hooshmand Yekta Co., commonName=Yekta Organization Validated SSL CA 1
- Issuer: countryName=PL, organizationName=Unizeto Technologies S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Global Services CA SHA2
- Serial: 2F60421DA95DCB213E5FF647B0B9A836
- SHA-256: 17F08A4F5DC38C49BB17DCD64B2CE742CFEAB99BE5B67DBC14C2E896771C60E1
- SPKI SHA-256: 51F8A1D55783C618DBB5E549357CA05CFD8C63F43C7396E6C06D0B97C0105D36
- Validity: 2021-01-20 to 2027-05-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://yektaov.crl.certum.pl/yektaov.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2f:60:42:1d:a9:5d:cb:21:3e:5f:f6:47:b0:b9:a8:36
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, O = Unizeto Technologies S.A., OU = Certum Certification Authority, CN = Certum Global Services CA SHA2
        Validity
            Not Before: Jan 20 10:21:15 2021 GMT
            Not After : May 31 10:21:15 2027 GMT
        Subject: C = IR, O = Pardazeshgaran Shahr Hooshmand Yekta Co., CN = Yekta Organization Validated SSL CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                86:ED:7F:8A:52:58:01:69:A6:31:1E:36:56:6B:1A:2E:6A:A7:42:B6
            X509v3 Authority Key Identifier:
                54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/gscasha2.crl
            Authority Information Access:
                OCSP - URI:http://subca.ocsp-certum.com
                CA Issuers - URI:http://repository.certum.pl/gscasha2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.certum.pl/CPS
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 17F08A4F5DC38C49BB17DCD64B2CE742CFEAB99BE5B67DBC14C2E896771C60E1
    SPKI SHA256: 51F8A1D55783C618DBB5E549357CA05CFD8C63F43C7396E6C06D0B97C0105D36
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://repository.certum.pl/gscasha2.cer
- CRL Distribution Points: http://subca.crl.certum.pl/gscasha2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### 宝塔 DV TLS CA

- Subject: countryName=CN, organizationName=广东堡塔安全技术有限公司, commonName=宝塔 DV TLS CA
- Issuer: countryName=PL, organizationName=Asseco Data Systems S.A., organizationalUnitName=Certum Certification Authority, commonName=Certum Trusted Root CA
- Serial: D21AD24C13255754888BB19C977A7754
- SHA-256: 7AEA9978F8E2030B972B7941DB2C0B67E9FF391A212E608F5AF3EAA989B059CA
- SPKI SHA-256: 7754693D62B7723178CC08BF7353AC803E37EE6B3430B8FA97B7C95235F04739
- Validity: 2025-01-15 to 2035-01-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://btdvtlsr35g2ca.crl.certum.pl/btdvtlsr35g2ca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://subca.ocsp-certum.com
- CRL DP: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d2:1a:d2:4c:13:25:57:54:88:8b:b1:9c:97:7a:77:54
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = PL, O = Asseco Data Systems S.A., OU = Certum Certification Authority, CN = Certum Trusted Root CA
        Validity
            Not Before: Jan 15 10:34:55 2025 GMT
            Not After : Jan  3 10:34:55 2035 GMT
        Subject: C = CN, O = \E5\B9\BF\E4\B8\9C\E5\A0\A1\E5\A1\94\E5\AE\89\E5\85\A8\E6\8A\80\E6\9C\AF\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = \E5\AE\9D\E5\A1\94 DV TLS CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://subca.repository.certum.pl/ctrca.cer
                OCSP - URI:http://subca.ocsp-certum.com
            X509v3 Authority Key Identifier:
                8C:FB:1C:75:BC:02:D3:9F:4E:2E:48:D9:F9:60:54:AA:C4:B3:4F:FA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://subca.crl.certum.pl/ctrca.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Subject Key Identifier:
                DB:4C:89:38:C4:27:EB:63:3F:72:F9:0A:D4:E9:42:DD:EC:99:73:A8
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 7AEA9978F8E2030B972B7941DB2C0B67E9FF391A212E608F5AF3EAA989B059CA
    SPKI SHA256: 7754693D62B7723178CC08BF7353AC803E37EE6B3430B8FA97B7C95235F04739
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://subca.ocsp-certum.com
- AIA CA Issuers: http://subca.repository.certum.pl/ctrca.cer
- CRL Distribution Points: http://subca.crl.certum.pl/ctrca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
