# CA Owner Audit Dump - Atos

Generated: 2026-08-07T18:55:54.005925Z

## CA Owner Summary

- Name: Atos
- Country: Germany
- Website: -
- Problem Reporting: pki-enterprise-tr[at]atos[dot]net, https://pki.atos.net
- CP/CPS URLs: https://pki.atos.net/trustcenter/en/download/trusted-root-ca, https://pki.atos.net/Download/Atos_TrustedRoot_CPS_v3.3.pdf
- Audit URLs: https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/Eviden_DSC1709_ATCA_Audit_Attestation.pdf, https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/Eviden_DSC1278_ATCA_Audit_Attestation_v12.pdf
- Root Programs: {"mozilla":"Included","chrome":"Removed","microsoft":"Included","apple":"Included"}

## Owner Disclosure Snapshot

- Problem reporting mechanism: pki-enterprise-tr[at]atos[dot]net, https://pki.atos.net
- CP/CPS URLs: https://pki.atos.net/trustcenter/en/download/trusted-root-ca, https://pki.atos.net/Download/Atos_TrustedRoot_CPS_v3.3.pdf
- Audit URLs: https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/Eviden_DSC1709_ATCA_Audit_Attestation.pdf, https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/Eviden_DSC1278_ATCA_Audit_Attestation_v12.pdf
- Repository URLs: https://pki.atos.net/trustcenter/en/download/trusted-root-ca
- Root programs: {"mozilla":"Included","chrome":"Removed","microsoft":"Included","apple":"Included"}
- Contact aliases: -

## Certificate Inventory

| # | Subject | CA | Lifecycle | Validity | Policies | pathLen | EKU | zlint |
|---|---|---|---|---|---|---|---|---|
| 1 | commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE | yes | unknown | 2011-07-07 to 2030-12-31 | 1.3.6.1.4.1.6189.3.4.1.1 | - | - | clean |
| 2 | countryName=DE, organizationName=Atos, commonName=Atos TrustedRoot Root CA ECC G2 2020 | yes | unknown | 2020-12-15 to 2040-12-10 | - | - | - | clean |
| 3 | commonName=Atos TrustedRoot Root CA ECC TLS 2021, organizationName=Atos, countryName=DE | yes | unknown | 2021-04-22 to 2041-04-17 | - | - | - | clean |
| 4 | countryName=DE, organizationName=Atos, commonName=Atos TrustedRoot Root CA RSA G2 2020 | yes | unknown | 2020-12-15 to 2040-12-10 | - | - | - | clean |
| 5 | commonName=Atos TrustedRoot Root CA RSA TLS 2021, organizationName=Atos, countryName=DE | yes | unknown | 2021-04-22 to 2041-04-17 | - | - | - | clean |
| 6 | countryName=DE, organizationName=Atos, commonName=Atos TrustedRoot Client CA ECC 2022 | yes | current | 2022-10-20 to 2032-10-17 | 1.3.6.1.4.1.6189.5.1.1.1.1 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login | clean |
| 7 | commonName=Atos TrustedRoot Client CA for NordLB 2021, organizationName=Atos, countryName=DE | yes | revoked | 2021-03-24 to 2030-03-22 | 1.3.6.1.4.1.6189.5.1.1.1.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 8 | countryName=DE, organizationName=Atos, commonName=Atos TrustedRoot Client CA RSA 2022 | yes | revoked | 2022-10-20 to 2032-10-17 | 1.3.6.1.4.1.6189.5.1.1.1.1 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login | clean |
| 9 | commonName=Atos TrustedRoot Client Issuing CA 2015, organizationName=Atos, countryName=DE | yes | expired | 2015-09-02 to 2025-08-30 | 1.3.6.1.4.1.6189.5.1.1.1 | - | - | historical errors: 2 |
| 10 | commonName=Atos TrustedRoot Client-CA 2011, organizationName=Atos, countryName=DE | yes | revoked, expired | 2011-07-07 to 2021-07-04 | 1.3.6.1.4.1.6189.3.4.1.1 | - | - | clean |
| 11 | commonName=Atos TrustedRoot Client-CA 2011, organizationName=Atos, countryName=DE | yes | revoked, expired | 2011-07-07 to 2021-07-04 | 1.3.6.1.4.1.6189.3.4.1.1 | - | - | clean |
| 12 | commonName=Atos TrustedRoot Client-CA 2011, organizationName=Atos, countryName=DE | yes | revoked, expired | 2011-07-07 to 2021-07-04 | 1.3.6.1.4.1.6189.3.4.1.1 | - | - | clean |
| 13 | commonName=Atos TrustedRoot Client-CA 2012, organizationName=Atos, countryName=DE | yes | expired | 2012-12-13 to 2022-12-13 | 1.3.6.1.4.1.6189.5.1.1.1 | - | - | historical errors: 2 |
| 14 | commonName=Atos TrustedRoot Client-CA 2013, organizationName=Atos, countryName=DE | yes | expired | 2013-05-02 to 2023-04-30 | 1.3.6.1.4.1.6189.5.1.1.1 | - | - | historical errors: 2 |
| 15 | commonName=Atos TrustedRoot Client-CA 2019, organizationName=Atos, countryName=DE | yes | revoked | 2019-10-30 to 2029-10-27 | 1.3.6.1.4.1.6189.5.1.1.1.1 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login, OCSP Signing | historical errors: 1 |
| 16 | commonName=Atos TrustedRoot Client-CA 2020, organizationName=Atos, countryName=DE | yes | current | 2020-07-07 to 2030-07-05 | 1.3.6.1.4.1.6189.5.1.1.1.1 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login | clean |
| 17 | commonName=Atos TrustedRoot Client-CA for Elopak 2022, organizationName=Atos, countryName=DE | yes | revoked | 2022-03-17 to 2030-03-15 | 1.3.6.1.4.1.6189.5.1.1.1.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 18 | commonName=Atos TrustedRoot Client-CA for Elopak G2 2022, organizationName=Atos, countryName=DE | yes | current | 2022-07-12 to 2030-07-10 | 1.3.6.1.4.1.6189.5.1.1.1.1 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login | clean |
| 19 | commonName=Atos TrustedRoot Client-CA for equensWorldlinePartner 2 2019, organizationName=Atos, countryName=DE | yes | revoked | 2019-06-20 to 2029-06-17 | 1.3.6.1.4.1.6189.5.1.1.1 | 0 | TLS Web Client Authentication, OCSP Signing | historical errors: 1 |
| 20 | commonName=Atos TrustedRoot Client-CA for equensWorldlinePartner 2017, organizationName=Atos, countryName=DE | yes | revoked | 2017-09-14 to 2027-09-12 | 1.3.6.1.4.1.6189.5.1.1.1 | 0 | - | clean |
| 21 | commonName=Atos TrustedRoot Client-CA for equensWorldlinePartner 2019, organizationName=Atos, countryName=DE | yes | revoked | 2019-05-08 to 2029-05-05 | 1.3.6.1.4.1.6189.5.1.1.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 22 | commonName=Atos TrustedRoot Client-CA for Lilium 2021, organizationName=Atos, countryName=DE | yes | revoked | 2021-07-07 to 2030-07-05 | 1.3.6.1.4.1.6189.5.1.1.1.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 23 | commonName=Atos TrustedRoot Client-CA for Paragon 2023, organizationName=Atos, countryName=DE | yes | revoked | 2023-01-11 to 2030-01-09 | 1.3.6.1.4.1.6189.5.1.1.1.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 24 | commonName=Atos TrustedRoot Client-CA for Primetals 2022, organizationName=Atos, countryName=DE | yes | current | 2022-03-17 to 2030-03-15 | 1.3.6.1.4.1.6189.5.1.1.1.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 25 | commonName=Atos TrustedRoot Client-CA for Primetals G2 2022, organizationName=Atos, countryName=DE | yes | current | 2022-05-04 to 2030-05-02 | 1.3.6.1.4.1.6189.5.1.1.1.1 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login | clean |
| 26 | commonName=Atos TrustedRoot Client-CA for SPIE 2021, organizationName=Atos, countryName=DE | yes | revoked | 2021-09-03 to 2030-09-01 | 1.3.6.1.4.1.6189.5.1.1.1.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 27 | commonName=Atos TrustedRoot Client-CA for Wintershall Dea 2 2020, organizationName=Atos, countryName=DE | yes | revoked | 2020-07-08 to 2030-07-06 | 1.3.6.1.4.1.6189.5.1.1.1.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 28 | commonName=Atos TrustedRoot Client-CA for Wintershall Dea 2020, organizationName=Atos, countryName=DE | yes | revoked | 2020-01-31 to 2030-01-28 | 1.3.6.1.4.1.6189.5.1.1.1.1 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing | historical errors: 1 |
| 29 | commonName=Atos TrustedRoot Client-CA for Worldline 2 2020, organizationName=Atos, countryName=DE | yes | revoked | 2020-07-08 to 2030-07-06 | 1.3.6.1.4.1.6189.5.1.1.1.1 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login | clean |
| 30 | commonName=Atos TrustedRoot Client-CA for Worldline 2020, organizationName=Atos, countryName=DE | yes | revoked | 2020-03-17 to 2030-03-15 | 1.3.6.1.4.1.6189.5.1.1.1.1 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login, OCSP Signing | historical errors: 1 |
| 31 | commonName=Atos TrustedRoot Client-CA for WWE 2022, organizationName=Atos, countryName=DE | yes | revoked | 2022-03-17 to 2030-03-15 | 1.3.6.1.4.1.6189.5.1.1.1.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 32 | commonName=Atos TrustedRoot CodeSign CA 2021, organizationName=Atos, countryName=DE | yes | current | 2021-04-14 to 2030-04-12 | 1.3.6.1.4.1.6189.5.1.1.1.2 | 0 | Code Signing | clean |
| 33 | commonName=Atos TrustedRoot CodeSigning-CA 2011, organizationName=Atos, countryName=DE | yes | revoked, expired | 2011-07-07 to 2021-07-04 | - | - | - | clean |
| 34 | commonName=Atos TrustedRoot CodeSigning-CA 2011, organizationName=Atos, countryName=DE | yes | revoked, expired | 2011-07-07 to 2021-07-04 | - | - | - | clean |
| 35 | commonName=Atos TrustedRoot CodeSigning-CA 2013, organizationName=Atos, countryName=DE | yes | expired | 2013-05-02 to 2023-04-30 | 1.3.6.1.4.1.6189.5.1.1.1 | - | - | historical errors: 2 |
| 36 | commonName=Atos TrustedRoot Issuing CA for Primetals 2015, organizationName=Atos, countryName=DE | yes | expired | 2015-05-07 to 2025-05-04 | 1.3.6.1.4.1.6189.5.1.1.1 | - | - | historical errors: 2 |
| 37 | commonName=Atos TrustedRoot Issuing CA for WWE 2015, organizationName=Atos, countryName=DE | yes | expired | 2015-05-07 to 2025-05-04 | 1.3.6.1.4.1.6189.5.1.1.1 | - | - | historical errors: 2 |
| 38 | commonName=Atos TrustedRoot Mailgateway CA 2019, organizationName=Atos, countryName=DE | yes | current | 2019-05-08 to 2029-05-05 | 1.3.6.1.4.1.6189.5.1.1.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 39 | commonName=Atos TrustedRoot Server CA ECC 2022, organizationName=Atos, countryName=DE | yes | current | 2022-07-12 to 2032-07-09 | 1.3.6.1.4.1.6189.5.1.1.1 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 40 | commonName=Atos TrustedRoot Server CA RSA 2022, organizationName=Atos, countryName=DE | yes | current | 2022-07-12 to 2032-07-09 | 1.3.6.1.4.1.6189.5.1.1.1 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 41 | commonName=Atos TrustedRoot Server-CA 2011, organizationName=Atos, countryName=DE | yes | revoked, expired | 2011-07-07 to 2021-07-04 | 1.3.6.1.4.1.6189.3.4.1.1 | - | - | clean |
| 42 | commonName=Atos TrustedRoot Server-CA 2011, organizationName=Atos, countryName=DE | yes | revoked, expired | 2011-07-07 to 2021-07-04 | 1.3.6.1.4.1.6189.3.4.1.1 | - | - | clean |
| 43 | commonName=Atos TrustedRoot Server-CA 2013, organizationName=Atos, countryName=DE | yes | expired | 2013-05-02 to 2023-04-30 | 1.3.6.1.4.1.6189.5.1.1.1 | - | - | historical errors: 2 |
| 44 | commonName=Atos TrustedRoot Server-CA 2017, organizationName=Atos, countryName=DE | yes | revoked | 2017-09-14 to 2027-09-12 | 1.3.6.1.4.1.6189.5.1.1.1 | 0 | - | clean |
| 45 | commonName=Atos TrustedRoot Server-CA 2019, organizationName=Atos, countryName=DE | yes | current | 2019-03-28 to 2029-03-25 | 1.3.6.1.4.1.6189.5.1.1.1 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 46 | commonName=Atos TrustedRoot Timestamp CA 2020, organizationName=Atos, countryName=DE | yes | current | 2020-09-15 to 2030-09-13 | 1.3.6.1.4.1.6189.5.1.1.1.5 | 0 | Time Stamping | clean |
| 47 | commonName=Eviden TrustedRoot Client CA for Atos 2023, organizationName=Eviden, countryName=DE | yes | current | 2023-06-28 to 2030-12-31 | 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login | clean |
| 48 | commonName=Eviden TrustedRoot Client CA for Bull 2026, organizationName=Eviden Germany GmbH, countryName=DE | yes | revoked | 2026-02-17 to 2030-12-31 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login | clean |
| 49 | commonName=Eviden TrustedRoot Client CA for Bull G2 2026, organizationName=Eviden Germany GmbH, countryName=DE | yes | current | 2026-02-19 to 2030-12-31 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login | clean |
| 50 | commonName=Eviden TrustedRoot Client CA for Elopak 2023, organizationName=Eviden, countryName=DE | yes | current | 2023-06-28 to 2030-12-31 | 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login | clean |
| 51 | commonName=Eviden TrustedRoot Client CA for Lilium 2023, organizationName=Eviden, countryName=DE | yes | revoked | 2023-06-28 to 2030-12-31 | 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 52 | commonName=Eviden TrustedRoot Client CA for NordLB 2023, organizationName=Eviden, countryName=DE | yes | current | 2023-06-28 to 2030-12-31 | 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 53 | commonName=Eviden TrustedRoot Client CA for Paragon G2 2023, organizationName=Eviden, countryName=DE | yes | current | 2023-06-28 to 2030-06-26 | 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 54 | commonName=Eviden TrustedRoot Client CA for Primetals 2023, organizationName=Eviden, countryName=DE | yes | current | 2023-06-28 to 2030-12-31 | 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login | clean |
| 55 | commonName=Eviden TrustedRoot Client CA for SPIE 2023, organizationName=Eviden, countryName=DE | yes | current | 2023-06-28 to 2030-12-31 | 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 56 | countryName=DE, organizationName=Eviden Germany GmbH, commonName=Eviden TrustedRoot Client CA for SPIE 2026 | yes | revoked | 2026-02-17 to 2036-02-15 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 57 | countryName=DE, organizationName=Eviden Germany GmbH, commonName=Eviden TrustedRoot Client CA for SPIE G2 2026 | yes | current | 2026-02-19 to 2036-02-17 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 58 | commonName=Eviden TrustedRoot Client CA for Wintershall Dea 2023, organizationName=Eviden, countryName=DE | yes | revoked | 2023-07-03 to 2030-12-31 | 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 59 | commonName=Eviden TrustedRoot Client CA for Wintershall Dea 2023, organizationName=Eviden, countryName=DE | yes | revoked | 2023-06-28 to 2030-12-31 | 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 60 | commonName=Eviden TrustedRoot Client CA for Wintershall Dea G2 2023, organizationName=Eviden, countryName=DE | yes | current | 2023-08-30 to 2030-12-31 | 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 61 | commonName=Eviden TrustedRoot Client CA for Worldline 2023, organizationName=Eviden, countryName=DE | yes | revoked | 2023-06-28 to 2030-12-31 | 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login | clean |
| 62 | commonName=Eviden TrustedRoot Client CA for WWE 2023, organizationName=Eviden, countryName=DE | yes | revoked | 2023-06-28 to 2030-12-31 | 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 63 | commonName=Eviden TrustedRoot Client CA for WWE G2 2023, organizationName=Eviden, countryName=DE | yes | revoked | 2023-07-03 to 2030-12-31 | 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login | clean |
| 64 | countryName=DE, organizationName=Eviden Germany GmbH, commonName=Eviden TrustedRoot Client CA SMIME RSA 2025 | yes | current | 2025-08-11 to 2035-08-09 | 1.3.6.1.4.1.6189.5.1.1.1.1.1, 2.23.140.1.5.1.2, 2.23.140.1.5.1.3, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3 | 0 | E-mail Protection | current errors: 1 |
| 65 | countryName=DE, organizationName=Eviden Germany GmbH, commonName=Eviden TrustedRoot Client CA SMIME RSA 2026 | yes | revoked | 2026-02-17 to 2036-02-15 | 2.5.29.32.0 | 0 | E-mail Protection | clean |
| 66 | countryName=DE, organizationName=Eviden Germany GmbH, commonName=Eviden TrustedRoot Client CA SMIME RSA G2 2026 | yes | current | 2026-02-19 to 2036-02-17 | 2.5.29.32.0 | 0 | E-mail Protection | clean |
| 67 | commonName=Eviden TrustedRoot Client-CA 2023, organizationName=Atos, countryName=DE | yes | revoked | 2023-04-04 to 2030-04-02 | 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3 | 0 | TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login | clean |
| 68 | commonName=Eviden TrustedRoot Client-CA G2 2023, organizationName=Atos, countryName=DE | yes | current | 2023-05-03 to 2030-05-01 | 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 2.23.140.1.5.3.1, 2.23.140.1.5.2.3, 2.23.140.1.5.2.2, 2.23.140.1.5.2.1 | 0 | TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login | clean |
| 69 | commonName=Eviden TrustedRoot Mailgateway CA 2023, organizationName=Eviden, countryName=DE | yes | revoked | 2023-06-28 to 2030-12-31 | 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login | clean |
| 70 | commonName=Eviden TrustedRoot Mailgateway CA G2 2023, organizationName=Eviden, countryName=DE | yes | current | 2023-07-03 to 2030-12-31 | 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3 | 0 | TLS Web Client Authentication, E-mail Protection | clean |

## Certificate Details

### Atos TrustedRoot 2011

- Subject: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 5C33CB622C5FB332
- SHA-256: F356BEA244B7A91EB35D53CA9AD7864ACE018E2D35D5F8F96DDF68A6F41AA474
- SPKI SHA-256: E5CA37BC7B6C361979BC6B123CA9A1DB019046D7FF5F57DFB854B19D10B0682F
- Validity: 2011-07-07 to 2030-12-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://pki.atos.net/Download/Atos_TrustedRoot_CPS_v3.3.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/Eviden_DSC1709_ATCA_Audit_Attestation.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Removed","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.3.4.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6643877497813316402 (0x5c33cb622c5fb332)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jul  7 14:58:30 2011 GMT
            Not After : Dec 31 23:59:59 2030 GMT
        Subject: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.3.4.1.1
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F356BEA244B7A91EB35D53CA9AD7864ACE018E2D35D5F8F96DDF68A6F41AA474
    SPKI SHA256: E5CA37BC7B6C361979BC6B123CA9A1DB019046D7FF5F57DFB854B19D10B0682F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.3.4.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies

### Atos TrustedRoot Root CA ECC G2 2020

- Subject: countryName=DE, organizationName=Atos, commonName=Atos TrustedRoot Root CA ECC G2 2020
- Issuer: countryName=DE, organizationName=Atos, commonName=Atos TrustedRoot Root CA ECC G2 2020
- Serial: 0B7328111874301CEF6F0884
- SHA-256: E38655F4B0190C84D3B3893D840A687E190A256D98052F159E6D4A39F589A6EB
- SPKI SHA-256: C3C0811992CCBC2C282D2C30022DBCE857DBA2A0CFB99887E33BB6986C916EAE
- Validity: 2020-12-15 to 2040-12-10
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://pki.atos.net/Download/Atos_TrustedRoot_CPS_v3.3.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/Eviden_DSC1709_ATCA_Audit_Attestation.pdf, https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/Eviden_DSC1278_ATCA_Audit_Attestation_v12.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_ECC_G2_2020.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0b:73:28:11:18:74:30:1c:ef:6f:08:84
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = Atos, CN = Atos TrustedRoot Root CA ECC G2 2020
        Validity
            Not Before: Dec 15 08:39:10 2020 GMT
            Not After : Dec 10 08:39:09 2040 GMT
        Subject: C = DE, O = Atos, CN = Atos TrustedRoot Root CA ECC G2 2020
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                5B:1F:C4:71:6C:B2:1B:9F:BE:5C:1F:8C:FD:B3:B6:FB:B3:0E:09:87
            X509v3 Subject Key Identifier:
                5B:1F:C4:71:6C:B2:1B:9F:BE:5C:1F:8C:FD:B3:B6:FB:B3:0E:09:87
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E38655F4B0190C84D3B3893D840A687E190A256D98052F159E6D4A39F589A6EB
    SPKI SHA256: C3C0811992CCBC2C282D2C30022DBCE857DBA2A0CFB99887E33BB6986C916EAE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Atos TrustedRoot Root CA ECC TLS 2021

- Subject: commonName=Atos TrustedRoot Root CA ECC TLS 2021, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot Root CA ECC TLS 2021, organizationName=Atos, countryName=DE
- Serial: 3D983BA6663D9063F77E26573804EF00
- SHA-256: B2FAE53E14CCD7AB9212064701AE279C1D8988FACB775FA8A008914E663988A8
- SPKI SHA-256: 608963C78C455E6E34B072468ACE0956CFF18D34643F9F305B7162FA181979FC
- Validity: 2021-04-22 to 2041-04-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://pki.atos.net/Download/Atos_TrustedRoot_CPS_v3.3.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/Eviden_DSC1709_ATCA_Audit_Attestation.pdf, https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/Eviden_DSC1278_ATCA_Audit_Attestation_v12.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3d:98:3b:a6:66:3d:90:63:f7:7e:26:57:38:04:ef:00
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: CN = Atos TrustedRoot Root CA ECC TLS 2021, O = Atos, C = DE
        Validity
            Not Before: Apr 22 09:26:23 2021 GMT
            Not After : Apr 17 09:26:22 2041 GMT
        Subject: CN = Atos TrustedRoot Root CA ECC TLS 2021, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                76:28:25:D6:7D:E0:66:9A:7A:09:B2:6A:3B:8E:33:D7:36:D3:4F:A2
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: B2FAE53E14CCD7AB9212064701AE279C1D8988FACB775FA8A008914E663988A8
    SPKI SHA256: 608963C78C455E6E34B072468ACE0956CFF18D34643F9F305B7162FA181979FC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Atos TrustedRoot Root CA RSA G2 2020

- Subject: countryName=DE, organizationName=Atos, commonName=Atos TrustedRoot Root CA RSA G2 2020
- Issuer: countryName=DE, organizationName=Atos, commonName=Atos TrustedRoot Root CA RSA G2 2020
- Serial: 47BA2946553E169297B0AB40
- SHA-256: 78833A783BB2986C254B9370D3C20E5EBA8FA7840CBF63FE17297A0B0119685E
- SPKI SHA-256: 21E94DDBFA686CBBFB802689F5B0D768356FB64E361DBCB7EAAD0F406BCB3171
- Validity: 2020-12-15 to 2040-12-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://pki.atos.net/Download/Atos_TrustedRoot_CPS_v3.3.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/Eviden_DSC1709_ATCA_Audit_Attestation.pdf, https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/Eviden_DSC1278_ATCA_Audit_Attestation_v12.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_G2_2020.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:ba:29:46:55:3e:16:92:97:b0:ab:40
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Atos, CN = Atos TrustedRoot Root CA RSA G2 2020
        Validity
            Not Before: Dec 15 08:41:23 2020 GMT
            Not After : Dec 10 08:41:22 2040 GMT
        Subject: C = DE, O = Atos, CN = Atos TrustedRoot Root CA RSA G2 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                20:25:F3:07:FD:A7:6F:F1:96:EE:91:10:69:CC:9A:EF:7D:C8:68:78
            X509v3 Subject Key Identifier:
                20:25:F3:07:FD:A7:6F:F1:96:EE:91:10:69:CC:9A:EF:7D:C8:68:78
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 78833A783BB2986C254B9370D3C20E5EBA8FA7840CBF63FE17297A0B0119685E
    SPKI SHA256: 21E94DDBFA686CBBFB802689F5B0D768356FB64E361DBCB7EAAD0F406BCB3171
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Atos TrustedRoot Root CA RSA TLS 2021

- Subject: commonName=Atos TrustedRoot Root CA RSA TLS 2021, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot Root CA RSA TLS 2021, organizationName=Atos, countryName=DE
- Serial: 53D5CFE619930BFB2B0512D8C22AA2A4
- SHA-256: 81A9088EA59FB364C548A6F85559099B6F0405EFBF18E5324EC9F457BA00112F
- SPKI SHA-256: F7CA77A610E3D42447240692DBD57CFD13CF042ACD2062E6A62B87B9ED81C1A7
- Validity: 2021-04-22 to 2041-04-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://pki.atos.net/Download/Atos_TrustedRoot_CPS_v3.3.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/Eviden_DSC1709_ATCA_Audit_Attestation.pdf, https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/Eviden_DSC1278_ATCA_Audit_Attestation_v12.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            53:d5:cf:e6:19:93:0b:fb:2b:05:12:d8:c2:2a:a2:a4
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: CN = Atos TrustedRoot Root CA RSA TLS 2021, O = Atos, C = DE
        Validity
            Not Before: Apr 22 09:21:10 2021 GMT
            Not After : Apr 17 09:21:09 2041 GMT
        Subject: CN = Atos TrustedRoot Root CA RSA TLS 2021, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                74:49:99:D1:FF:B4:7A:68:45:75:C3:7E:B4:DC:CC:CE:39:33:DA:08
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 81A9088EA59FB364C548A6F85559099B6F0405EFBF18E5324EC9F457BA00112F
    SPKI SHA256: F7CA77A610E3D42447240692DBD57CFD13CF042ACD2062E6A62B87B9ED81C1A7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Atos TrustedRoot Client CA ECC 2022

- Subject: countryName=DE, organizationName=Atos, commonName=Atos TrustedRoot Client CA ECC 2022
- Issuer: countryName=DE, organizationName=Atos, commonName=Atos TrustedRoot Root CA ECC G2 2020
- Serial: 61384433FBA18358F633A548
- SHA-256: 6875A09A2728A3066AD345376835123297E318FA89649DC4C03A2105086B09A3
- SPKI SHA-256: AB6F07D1E36675A0A4975AEE176275ECE0441544D0B0CCA10785433500890B01
- Validity: 2022-10-20 to 2032-10-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Client_CA_ECC_2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%20Root%20CA%20ECC%20G2%202020, http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_ECC_G2_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:38:44:33:fb:a1:83:58:f6:33:a5:48
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = Atos, CN = Atos TrustedRoot Root CA ECC G2 2020
        Validity
            Not Before: Oct 20 08:29:21 2022 GMT
            Not After : Oct 17 08:29:20 2032 GMT
        Subject: C = DE, O = Atos, CN = Atos TrustedRoot Client CA ECC 2022
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                5B:1F:C4:71:6C:B2:1B:9F:BE:5C:1F:8C:FD:B3:B6:FB:B3:0E:09:87
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRootRootCAECCG22020.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%20Root%20CA%20ECC%20G2%202020,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot Root CA ECC G2 2020, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_ECC_G2_2020.crl
            X509v3 Subject Key Identifier:
                20:BF:69:E7:02:82:28:FC:5A:42:69:6E:AA:AD:A9:21:04:B8:0D:51
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 6875A09A2728A3066AD345376835123297E318FA89649DC4C03A2105086B09A3
    SPKI SHA256: AB6F07D1E36675A0A4975AEE176275ECE0441544D0B0CCA10785433500890B01
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRootRootCAECCG22020.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%20Root%20CA%20ECC%20G2%202020, http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_ECC_G2_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Client CA for NordLB 2021

- Subject: commonName=Atos TrustedRoot Client CA for NordLB 2021, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 79FC2E3F19F96F0C1A77F1F55EB7E938
- SHA-256: DBB9EAB4A2C66C77F30B266991DC2CE5E670FD8AE464545E236A9F5FEB4A4EFA
- SPKI SHA-256: F58DC12DCC21E81FDBE4BACDEB28FAF63B03D4175CC51AABADFDE01411A736CC
- Validity: 2021-03-24 to 2030-03-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Client_CA_for_NordLB_2021.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:fc:2e:3f:19:f9:6f:0c:1a:77:f1:f5:5e:b7:e9:38
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Mar 24 10:22:03 2021 GMT
            Not After : Mar 22 10:22:02 2030 GMT
        Subject: CN = Atos TrustedRoot Client CA for NordLB 2021, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/Download
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                05:7C:5E:0D:31:04:9E:F3:F1:2D:74:D0:5E:7F:09:CE:08:16:BB:A4
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DBB9EAB4A2C66C77F30B266991DC2CE5E670FD8AE464545E236A9F5FEB4A4EFA
    SPKI SHA256: F58DC12DCC21E81FDBE4BACDEB28FAF63B03D4175CC51AABADFDE01411A736CC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Client CA RSA 2022

- Subject: countryName=DE, organizationName=Atos, commonName=Atos TrustedRoot Client CA RSA 2022
- Issuer: countryName=DE, organizationName=Atos, commonName=Atos TrustedRoot Root CA RSA G2 2020
- Serial: 22AFEB8CFA4048BAB20983F1
- SHA-256: D32DAA164D7D2794391B98ACCF5B14A63B5538AAD13185141E242BE69327B0D6
- SPKI SHA-256: C8C032A8FE4EB13D933835AD84D4F78E3BFFD8F0CDE26998293FB8A32883C42C
- Validity: 2022-10-20 to 2032-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Client_CA_RSA_2022.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%20Root%20CA%20RSA%20G2%202020, http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_G2_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:af:eb:8c:fa:40:48:ba:b2:09:83:f1
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Atos, CN = Atos TrustedRoot Root CA RSA G2 2020
        Validity
            Not Before: Oct 20 08:27:41 2022 GMT
            Not After : Oct 17 08:27:40 2032 GMT
        Subject: C = DE, O = Atos, CN = Atos TrustedRoot Client CA RSA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                20:25:F3:07:FD:A7:6F:F1:96:EE:91:10:69:CC:9A:EF:7D:C8:68:78
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRootRootCARSAG22020.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%20Root%20CA%20RSA%20G2%202020,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot Root CA RSA G2 2020, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_G2_2020.crl
            X509v3 Subject Key Identifier:
                06:41:A9:D9:33:66:95:51:FD:09:6E:47:8D:FB:16:33:31:14:ED:79
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D32DAA164D7D2794391B98ACCF5B14A63B5538AAD13185141E242BE69327B0D6
    SPKI SHA256: C8C032A8FE4EB13D933835AD84D4F78E3BFFD8F0CDE26998293FB8A32883C42C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRootRootCARSAG22020.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%20Root%20CA%20RSA%20G2%202020, http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_G2_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Client Issuing CA 2015

- Subject: commonName=Atos TrustedRoot Client Issuing CA 2015, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 746CD78D59E9D180
- SHA-256: 40F47955BEA3EA726CADAC5D3FE61297FE7BEBAE5B0509E1EF7B29C838F49D20
- SPKI SHA-256: B639C85202979B31F6A61EEA75EABFDE79B5C4CAA018FB4D27C98CD7D65CBBE3
- Validity: 2015-09-02 to 2025-08-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Client_Issuing_CA_2015.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 8389317207983247744 (0x746cd78d59e9d180)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Sep  2 07:53:37 2015 GMT
            Not After : Aug 30 07:53:37 2025 GMT
        Subject: CN = Atos TrustedRoot Client Issuing CA 2015, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D8:CD:70:DB:06:22:07:FC:B9:13:6B:79:39:EF:3D:DD:5C:75:D7:FC
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 40F47955BEA3EA726CADAC5D3FE61297FE7BEBAE5B0509E1EF7B29C838F49D20
    SPKI SHA256: B639C85202979B31F6A61EEA75EABFDE79B5C4CAA018FB4D27C98CD7D65CBBE3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- is_expired

### Atos TrustedRoot Client-CA 2011

- Subject: commonName=Atos TrustedRoot Client-CA 2011, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 5B6A8E8D5A86718F
- SHA-256: B5E147438A69E24EBE7A4B940CF4963B81EECD56B8242482F75AD907276ADE97
- SPKI SHA-256: F09C35FA35E893A1B3EFCFF8DE703EF0503A626D4E6C4818328802375B3371D0
- Validity: 2011-07-07 to 2021-07-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.3.4.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://pki.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6587234142743064975 (0x5b6a8e8d5a86718f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jul  7 15:04:11 2011 GMT
            Not After : Jul  4 15:04:11 2021 GMT
        Subject: CN = Atos TrustedRoot Client-CA 2011, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D0:95:97:D8:30:32:B6:9F:63:E7:E0:59:60:4D:1D:08:CA:F0:F4:E2
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.3.4.1.1
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:C = DE, O = Atos, CN = Atos TrustedRoot 2011
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B5E147438A69E24EBE7A4B940CF4963B81EECD56B8242482F75AD907276ADE97
    SPKI SHA256: F09C35FA35E893A1B3EFCFF8DE703EF0503A626D4E6C4818328802375B3371D0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.3.4.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://pki.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- is_expired

### Atos TrustedRoot Client-CA 2011

- Subject: commonName=Atos TrustedRoot Client-CA 2011, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 5B6A8E8D5A86718F
- SHA-256: 32BA5FC4567E624224BB24470CC2F79AF1F0E4BC023EFD6DCD271FC29E110EF5
- SPKI SHA-256: F09C35FA35E893A1B3EFCFF8DE703EF0503A626D4E6C4818328802375B3371D0
- Validity: 2011-07-07 to 2021-07-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://pki-crl.atos.net/crl/Atos_TrustedRoot_Client_CA_for_Worldline_2_2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.3.4.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6587234142743064975 (0x5b6a8e8d5a86718f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jul  7 15:04:11 2011 GMT
            Not After : Jul  4 15:04:11 2021 GMT
        Subject: CN = Atos TrustedRoot Client-CA 2011, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D0:95:97:D8:30:32:B6:9F:63:E7:E0:59:60:4D:1D:08:CA:F0:F4:E2
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.3.4.1.1
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:C = DE, O = Atos, CN = Atos TrustedRoot 2011
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 32BA5FC4567E624224BB24470CC2F79AF1F0E4BC023EFD6DCD271FC29E110EF5
    SPKI SHA256: F09C35FA35E893A1B3EFCFF8DE703EF0503A626D4E6C4818328802375B3371D0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.3.4.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- is_expired

### Atos TrustedRoot Client-CA 2011

- Subject: commonName=Atos TrustedRoot Client-CA 2011, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 5B6A8E8D5A86718F
- SHA-256: 140DCFC461F014D0CB5EA59BE0840D6F6EC4558539E12A99531CE7DF938F7AEE
- SPKI SHA-256: F09C35FA35E893A1B3EFCFF8DE703EF0503A626D4E6C4818328802375B3371D0
- Validity: 2011-07-07 to 2021-07-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.3.4.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6587234142743064975 (0x5b6a8e8d5a86718f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jul  7 15:04:11 2011 GMT
            Not After : Jul  4 15:04:11 2021 GMT
        Subject: CN = Atos TrustedRoot Client-CA 2011, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D0:95:97:D8:30:32:B6:9F:63:E7:E0:59:60:4D:1D:08:CA:F0:F4:E2
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.3.4.1.1
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 140DCFC461F014D0CB5EA59BE0840D6F6EC4558539E12A99531CE7DF938F7AEE
    SPKI SHA256: F09C35FA35E893A1B3EFCFF8DE703EF0503A626D4E6C4818328802375B3371D0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.3.4.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- is_expired

### Atos TrustedRoot Client-CA 2012

- Subject: commonName=Atos TrustedRoot Client-CA 2012, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 20ED0CE9F4BBC1DE
- SHA-256: 4CB5CB705D4952497B4ED7C46A8564EA5C9137279F38C86B7BCA8E8883868B09
- SPKI SHA-256: 426A0664FADB11D1BC8A1FA05151F5DBBF50A8D333101953C93E92B26666E30A
- Validity: 2012-12-13 to 2022-12-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Client_CA_2012.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://atospki/crl/Atos_TrustedRoot_CA_2011.crl, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2372566777666978270 (0x20ed0ce9f4bbc1de)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Dec 13 14:21:50 2012 GMT
            Not After : Dec 13 14:21:50 2022 GMT
        Subject: CN = Atos TrustedRoot Client-CA 2012, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                25:DD:1C:35:6C:C1:1F:05:8C:4A:2C:25:39:BB:AA:96:F9:C0:DD:7C
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://atospki/crl/Atos_TrustedRoot_CA_2011.crl
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl                CRL Issuer:
                  DirName:C = DE, O = Atos, CN = Atos TrustedRoot 2011
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4CB5CB705D4952497B4ED7C46A8564EA5C9137279F38C86B7BCA8E8883868B09
    SPKI SHA256: 426A0664FADB11D1BC8A1FA05151F5DBBF50A8D333101953C93E92B26666E30A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://atospki/crl/Atos_TrustedRoot_CA_2011.crl, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- is_expired

### Atos TrustedRoot Client-CA 2013

- Subject: commonName=Atos TrustedRoot Client-CA 2013, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 703818B15938311A
- SHA-256: E0A4A91C50AFC4FB2CECDEB41ED8CAE72BF0144FB0D628B493FEAC511120FD73
- SPKI SHA-256: C75E78E08CFC60B48D8EA174090D4974A12489F9F4019DE1FD066DFCC8A81318
- Validity: 2013-05-02 to 2023-04-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Client_CA_2013.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 8086240280928858394 (0x703818b15938311a)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: May  2 13:56:14 2013 GMT
            Not After : Apr 30 13:56:14 2023 GMT
        Subject: CN = Atos TrustedRoot Client-CA 2013, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                90:ED:73:C3:E8:52:D1:5B:0C:EC:49:3B:89:C9:BC:2D:3A:65:BE:93
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E0A4A91C50AFC4FB2CECDEB41ED8CAE72BF0144FB0D628B493FEAC511120FD73
    SPKI SHA256: C75E78E08CFC60B48D8EA174090D4974A12489F9F4019DE1FD066DFCC8A81318
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- is_expired

### Atos TrustedRoot Client-CA 2019

- Subject: commonName=Atos TrustedRoot Client-CA 2019, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 45D55FA833C6ABEB04
- SHA-256: 550749FF5E35C407D515D98B327504BC484FDAAE28A713AFE4E2282986BE04E8
- SPKI SHA-256: 09C5CC62E92F8A510AD290CC59A6FB4845E1FDF32CEEDBF530BAD03BD0D71831
- Validity: 2019-10-30 to 2029-10-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:d5:5f:a8:33:c6:ab:eb:04
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Oct 30 14:00:03 2019 GMT
            Not After : Oct 27 14:00:03 2029 GMT
        Subject: CN = Atos TrustedRoot Client-CA 2019, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/Download
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login, OCSP Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                42:E3:F3:9D:83:99:41:3E:22:C7:FC:F7:ED:75:9F:07:79:1F:57:D8
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 550749FF5E35C407D515D98B327504BC484FDAAE28A713AFE4E2282986BE04E8
    SPKI SHA256: 09C5CC62E92F8A510AD290CC59A6FB4845E1FDF32CEEDBF530BAD03BD0D71831
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Client-CA 2020

- Subject: commonName=Atos TrustedRoot Client-CA 2020, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 6B872B6E81D8F5AD3C7D6416EB740681
- SHA-256: 5317DF82FB9A88993FA067D8352BC4195B84BBD0C698A1EDD7AF97C9DD90D879
- SPKI SHA-256: 6289AB64855B5CD2D28994B758BBDAE0A5D9C54444FDB1285DB13232C4A54082
- Validity: 2020-07-07 to 2030-07-05
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Client_CA_2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6b:87:2b:6e:81:d8:f5:ad:3c:7d:64:16:eb:74:06:81
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jul  7 06:19:41 2020 GMT
            Not After : Jul  5 06:19:41 2030 GMT
        Subject: CN = Atos TrustedRoot Client-CA 2020, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/Download
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                89:CF:EB:7D:8D:EF:48:31:47:46:FE:4B:B3:6D:7A:54:A3:E3:AD:03
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5317DF82FB9A88993FA067D8352BC4195B84BBD0C698A1EDD7AF97C9DD90D879
    SPKI SHA256: 6289AB64855B5CD2D28994B758BBDAE0A5D9C54444FDB1285DB13232C4A54082
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Client-CA for Elopak 2022

- Subject: commonName=Atos TrustedRoot Client-CA for Elopak 2022, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 277EA6FC4E1CF13B01D5E0A5CD5AEA57
- SHA-256: 2B3A81190AB6F193A3AD948247231BF6CB483CC28452B679CE1A8BC802429EB9
- SPKI SHA-256: D7E97E9D9B6848BFF7B541D4B44287385C1752F44AD0626E25C98649461B2BFA
- Validity: 2022-03-17 to 2030-03-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Client_CA_for_Elopak_2022.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            27:7e:a6:fc:4e:1c:f1:3b:01:d5:e0:a5:cd:5a:ea:57
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Mar 17 13:25:03 2022 GMT
            Not After : Mar 15 13:25:02 2030 GMT
        Subject: CN = Atos TrustedRoot Client-CA for Elopak 2022, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                FA:96:FF:C5:F8:D1:34:B8:FA:8E:40:A1:4F:5C:24:D5:86:3D:FF:DA
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2B3A81190AB6F193A3AD948247231BF6CB483CC28452B679CE1A8BC802429EB9
    SPKI SHA256: D7E97E9D9B6848BFF7B541D4B44287385C1752F44AD0626E25C98649461B2BFA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Client-CA for Elopak G2 2022

- Subject: commonName=Atos TrustedRoot Client-CA for Elopak G2 2022, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 59FDE03BA3A8E9B86F11CECF9DC1F4DE
- SHA-256: 079945DE25532CA107DD377C8C863663653E30219C7EB16866BE220542A2BEA9
- SPKI SHA-256: 99514D9F1D8E7445EEC379AE5EF7FB7BA2ABD391378B68CC6B81B8681A286E0A
- Validity: 2022-07-12 to 2030-07-10
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Client_CA_for_Elopak_G2_2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            59:fd:e0:3b:a3:a8:e9:b8:6f:11:ce:cf:9d:c1:f4:de
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jul 12 10:57:35 2022 GMT
            Not After : Jul 10 10:57:34 2030 GMT
        Subject: CN = Atos TrustedRoot Client-CA for Elopak G2 2022, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                78:54:07:68:2A:FF:5F:32:69:32:A6:B3:FE:F9:EC:B1:ED:90:1F:A3
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 079945DE25532CA107DD377C8C863663653E30219C7EB16866BE220542A2BEA9
    SPKI SHA256: 99514D9F1D8E7445EEC379AE5EF7FB7BA2ABD391378B68CC6B81B8681A286E0A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Client-CA for equensWorldlinePartner 2 2019

- Subject: commonName=Atos TrustedRoot Client-CA for equensWorldlinePartner 2 2019, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 7032B8DD738585E890
- SHA-256: 739D0C3A71B6C377CBD1C408AE7CC19732C2CBEF8620D63B16C9FD0185DF9A71
- SPKI SHA-256: 998CD5272896F2B0868182AC6B666A61E2710EB3FE00FD80031FA04BE2696E02
- Validity: 2019-06-20 to 2029-06-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            70:32:b8:dd:73:85:85:e8:90
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jun 20 11:19:45 2019 GMT
            Not After : Jun 17 11:19:45 2029 GMT
        Subject: CN = Atos TrustedRoot Client-CA for equensWorldlinePartner 2 2019, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1
                  CPS: http://pki.atos.net/Download
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, OCSP Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                2A:61:AC:1F:CE:14:EB:6F:D6:3D:05:B6:DD:0D:72:CC:B0:8F:3B:9F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 739D0C3A71B6C377CBD1C408AE7CC19732C2CBEF8620D63B16C9FD0185DF9A71
    SPKI SHA256: 998CD5272896F2B0868182AC6B666A61E2710EB3FE00FD80031FA04BE2696E02
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Client-CA for equensWorldlinePartner 2017

- Subject: commonName=Atos TrustedRoot Client-CA for equensWorldlinePartner 2017, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 7AC2A513C589121C
- SHA-256: 7AF4F0DCC03F9D2BD345F264B93E0432EA02260BD618263FC557DCF1266C07AB
- SPKI SHA-256: 162B486F07A574EC155C5FE01141527D249A12B3B751FD48E1326340F9B123B1
- Validity: 2017-09-14 to 2027-09-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 8845814122446131740 (0x7ac2a513c589121c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Sep 14 12:16:18 2017 GMT
            Not After : Sep 12 12:16:18 2027 GMT
        Subject: CN = Atos TrustedRoot Client-CA for equensWorldlinePartner 2017, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList
            X509v3 Subject Key Identifier:
                DA:20:A1:D8:83:4D:44:07:94:AA:60:F3:81:38:8B:62:C4:04:46:A4
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7AF4F0DCC03F9D2BD345F264B93E0432EA02260BD618263FC557DCF1266C07AB
    SPKI SHA256: 162B486F07A574EC155C5FE01141527D249A12B3B751FD48E1326340F9B123B1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- AIA OCSP: -
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Atos TrustedRoot Client-CA for equensWorldlinePartner 2019

- Subject: commonName=Atos TrustedRoot Client-CA for equensWorldlinePartner 2019, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 12AF0CD2187DB140C4
- SHA-256: 0CE33A4271B1E46CFFB432DB83A4F9C5261AF88BF2451D8AEF9021F60B20BE65
- SPKI SHA-256: 8B033ED8F56548FE9B96BF6FBBE74B1D91A44E3DF14212D2276BEB3799A26744
- Validity: 2019-05-08 to 2029-05-05
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Client_CA_for_equensWorldlinePartner_2019.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            12:af:0c:d2:18:7d:b1:40:c4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: May  8 09:23:39 2019 GMT
            Not After : May  5 09:23:39 2029 GMT
        Subject: CN = Atos TrustedRoot Client-CA for equensWorldlinePartner 2019, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1
                  CPS: http://pki.atos.net/Download
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                CB:45:43:B9:96:8C:60:69:BE:1D:00:33:3D:0E:6E:5B:29:38:2E:CE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0CE33A4271B1E46CFFB432DB83A4F9C5261AF88BF2451D8AEF9021F60B20BE65
    SPKI SHA256: 8B033ED8F56548FE9B96BF6FBBE74B1D91A44E3DF14212D2276BEB3799A26744
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Client-CA for Lilium 2021

- Subject: commonName=Atos TrustedRoot Client-CA for Lilium 2021, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 5B70DE1B61D8EC6229756395EB035353
- SHA-256: 2FAFCBF54A61504C40CDB3667DDAC88CEBD0F19F5C35348E03A1F8AF4C1DEC7E
- SPKI SHA-256: 108DD1ECBBC6EB857F9A9A989B622611120916EB9E6F2D6E4CBB5077D762517E
- Validity: 2021-07-07 to 2030-07-05
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Client_CA_for_Lilium_2021.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5b:70:de:1b:61:d8:ec:62:29:75:63:95:eb:03:53:53
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jul  7 12:40:05 2021 GMT
            Not After : Jul  5 12:40:04 2030 GMT
        Subject: CN = Atos TrustedRoot Client-CA for Lilium 2021, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                F6:83:0D:FF:3A:A7:B9:20:71:E8:67:A0:4E:A1:A5:CB:86:FA:52:F7
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2FAFCBF54A61504C40CDB3667DDAC88CEBD0F19F5C35348E03A1F8AF4C1DEC7E
    SPKI SHA256: 108DD1ECBBC6EB857F9A9A989B622611120916EB9E6F2D6E4CBB5077D762517E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Client-CA for Paragon 2023

- Subject: commonName=Atos TrustedRoot Client-CA for Paragon 2023, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 43A96920CC44A9B5FFB656848F0B8094
- SHA-256: 3BFEC4D64F072ED6FD69E34DBC742C15225176E2493CD57A5FB6DE839FA3BFA9
- SPKI SHA-256: 64A1A088031EFF60624AC205C2C3111ABCF03DA01299D215D5FF52350F267952
- Validity: 2023-01-11 to 2030-01-09
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://pki-crl.atos.net/crl/Atos_TrustedRoot_Client_CA_for_Paragon_2023.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            43:a9:69:20:cc:44:a9:b5:ff:b6:56:84:8f:0b:80:94
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jan 11 13:07:14 2023 GMT
            Not After : Jan  9 13:07:13 2030 GMT
        Subject: CN = Atos TrustedRoot Client-CA for Paragon 2023, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                31:CA:60:03:76:38:ED:60:BF:EF:D7:FE:7F:1D:DC:B4:AC:45:2B:F4
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3BFEC4D64F072ED6FD69E34DBC742C15225176E2493CD57A5FB6DE839FA3BFA9
    SPKI SHA256: 64A1A088031EFF60624AC205C2C3111ABCF03DA01299D215D5FF52350F267952
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Client-CA for Primetals 2022

- Subject: commonName=Atos TrustedRoot Client-CA for Primetals 2022, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 3C90BF704FDFC343091A4986CB906353
- SHA-256: 4F36C688E8F4409DAB5E8FF32E535C4937B2A73B9BD04855BC5D6528088CD1AF
- SPKI SHA-256: 67186E562FE28316235C2BF85FA2D2261575AFCF007F00BD113E83DA9EBC9EC0
- Validity: 2022-03-17 to 2030-03-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Client_CA_for_Primetals_2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3c:90:bf:70:4f:df:c3:43:09:1a:49:86:cb:90:63:53
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Mar 17 13:14:32 2022 GMT
            Not After : Mar 15 13:14:31 2030 GMT
        Subject: CN = Atos TrustedRoot Client-CA for Primetals 2022, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                A2:DC:AE:30:09:B9:65:F9:B0:2A:87:50:26:9D:45:47:6D:30:F9:AC
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4F36C688E8F4409DAB5E8FF32E535C4937B2A73B9BD04855BC5D6528088CD1AF
    SPKI SHA256: 67186E562FE28316235C2BF85FA2D2261575AFCF007F00BD113E83DA9EBC9EC0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Client-CA for Primetals G2 2022

- Subject: commonName=Atos TrustedRoot Client-CA for Primetals G2 2022, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 63AF1C4DACB8AC5A04747591D4123018
- SHA-256: 2445879506C19F122716F5BAD351CB73415CDF6186E8741B34FA1C956A198B5E
- SPKI SHA-256: B318A8653716206F5D847D2026E95B86B0BCAA3E779E4E2CA218440CF6B45DCF
- Validity: 2022-05-04 to 2030-05-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Client_CA_for_Primetals_G2_2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            63:af:1c:4d:ac:b8:ac:5a:04:74:75:91:d4:12:30:18
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: May  4 12:19:30 2022 GMT
            Not After : May  2 12:19:29 2030 GMT
        Subject: CN = Atos TrustedRoot Client-CA for Primetals G2 2022, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                FD:88:CA:A8:0B:EA:2F:12:7F:A9:50:BC:AF:EF:09:5F:08:49:1D:4C
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2445879506C19F122716F5BAD351CB73415CDF6186E8741B34FA1C956A198B5E
    SPKI SHA256: B318A8653716206F5D847D2026E95B86B0BCAA3E779E4E2CA218440CF6B45DCF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Client-CA for SPIE 2021

- Subject: commonName=Atos TrustedRoot Client-CA for SPIE 2021, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 6C9D9905D2F6EE554081141B15A9A3CB
- SHA-256: 14F2289F8C80C7F299D274B9ABFC8F6FDB5B66E73D9AF75BD2744F1BED004155
- SPKI SHA-256: 8A416BB073E9A8285E4426F41F415F25A691D380117007BF3F1DAABC8396667D
- Validity: 2021-09-03 to 2030-09-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Client_CA_for_SPIE_2021.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6c:9d:99:05:d2:f6:ee:55:40:81:14:1b:15:a9:a3:cb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Sep  3 08:59:08 2021 GMT
            Not After : Sep  1 08:59:07 2030 GMT
        Subject: CN = Atos TrustedRoot Client-CA for SPIE 2021, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                D1:92:2A:9E:77:77:2E:51:F8:A3:3F:02:80:FD:EB:8D:63:E4:A3:25
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 14F2289F8C80C7F299D274B9ABFC8F6FDB5B66E73D9AF75BD2744F1BED004155
    SPKI SHA256: 8A416BB073E9A8285E4426F41F415F25A691D380117007BF3F1DAABC8396667D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Client-CA for Wintershall Dea 2 2020

- Subject: commonName=Atos TrustedRoot Client-CA for Wintershall Dea 2 2020, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 60B859F18FF7356F740A7E6D3D642F75
- SHA-256: AA923D9DFCC7982FE4D56A71F53004C92076F1A30DCE9575016AB4FE08DCF820
- SPKI SHA-256: 600E9FCF3B8E2CB419227B07B2BBAAD13402460D67DDAA5BE3B259DA37FCEE9B
- Validity: 2020-07-08 to 2030-07-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Client_CA_for_Wintershall_Dea_2_2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            60:b8:59:f1:8f:f7:35:6f:74:0a:7e:6d:3d:64:2f:75
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jul  8 09:13:05 2020 GMT
            Not After : Jul  6 09:13:05 2030 GMT
        Subject: CN = Atos TrustedRoot Client-CA for Wintershall Dea 2 2020, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/Download
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                F1:A6:BD:05:AF:03:A7:E5:79:76:E1:10:20:C1:B5:F6:09:D2:9B:0F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AA923D9DFCC7982FE4D56A71F53004C92076F1A30DCE9575016AB4FE08DCF820
    SPKI SHA256: 600E9FCF3B8E2CB419227B07B2BBAAD13402460D67DDAA5BE3B259DA37FCEE9B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Client-CA for Wintershall Dea 2020

- Subject: commonName=Atos TrustedRoot Client-CA for Wintershall Dea 2020, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 69D489FF61DB0E8253
- SHA-256: 41ABE8F9A951A8990FBDCD3E14CF479D426401B115F0170189B665E940C3632C
- SPKI SHA-256: CDC264BCAECD72E94C0F8247ACB668E3DB395F9DB48634ADAECAA5A5DB60802C
- Validity: 2020-01-31 to 2030-01-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            69:d4:89:ff:61:db:0e:82:53
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jan 31 11:20:20 2020 GMT
            Not After : Jan 28 11:20:20 2030 GMT
        Subject: CN = Atos TrustedRoot Client-CA for Wintershall Dea 2020, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/Download
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                67:A8:4E:7F:E7:74:AB:16:FE:05:E7:69:DF:B6:82:06:00:FA:36:56
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 41ABE8F9A951A8990FBDCD3E14CF479D426401B115F0170189B665E940C3632C
    SPKI SHA256: CDC264BCAECD72E94C0F8247ACB668E3DB395F9DB48634ADAECAA5A5DB60802C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Client-CA for Worldline 2 2020

- Subject: commonName=Atos TrustedRoot Client-CA for Worldline 2 2020, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 70180AC41EB1F60B2DC03043A29D2E0A
- SHA-256: 6C5DC34D9D7402E0291416CC8D337B3302E131F1C8543FCEDC14E739153223B1
- SPKI SHA-256: 0704A5C371B05304C72FFB11E5F6345EB954D5660EA8EDB3D02C66F741E7BBDE
- Validity: 2020-07-08 to 2030-07-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Client_CA_for_Worldline_2_2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            70:18:0a:c4:1e:b1:f6:0b:2d:c0:30:43:a2:9d:2e:0a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jul  8 09:17:13 2020 GMT
            Not After : Jul  6 09:17:13 2030 GMT
        Subject: CN = Atos TrustedRoot Client-CA for Worldline 2 2020, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/Download
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                3E:4D:DA:D8:1D:27:62:62:9F:5A:F6:F0:82:66:A1:0B:EE:EB:41:C2
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6C5DC34D9D7402E0291416CC8D337B3302E131F1C8543FCEDC14E739153223B1
    SPKI SHA256: 0704A5C371B05304C72FFB11E5F6345EB954D5660EA8EDB3D02C66F741E7BBDE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Client-CA for Worldline 2020

- Subject: commonName=Atos TrustedRoot Client-CA for Worldline 2020, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 71E653F265521FF629
- SHA-256: 88AB961F64F9368F4C4D1307F59D4E59C5E570F852A6C5113A8FF28E04315157
- SPKI SHA-256: CCF44B8249345DDACBF3FE8BCEEE737B88BC85BE3FF762E8308FB77A1CBEFBE7
- Validity: 2020-03-17 to 2030-03-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            71:e6:53:f2:65:52:1f:f6:29
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Mar 17 11:02:49 2020 GMT
            Not After : Mar 15 11:02:49 2030 GMT
        Subject: CN = Atos TrustedRoot Client-CA for Worldline 2020, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/Download
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login, OCSP Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                E8:D4:E9:1B:2C:C0:85:7C:9F:27:C9:4A:F1:A7:E9:EA:01:52:FD:C1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 88AB961F64F9368F4C4D1307F59D4E59C5E570F852A6C5113A8FF28E04315157
    SPKI SHA256: CCF44B8249345DDACBF3FE8BCEEE737B88BC85BE3FF762E8308FB77A1CBEFBE7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login, OCSP Signing
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Client-CA for WWE 2022

- Subject: commonName=Atos TrustedRoot Client-CA for WWE 2022, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 033E333929E04B11B1A2FD2930F5A55C
- SHA-256: 30A09C203376CEC8C1545DEAEFD672A67130D9C0744E5A1E188C6517713137C6
- SPKI SHA-256: 9340193B125F8CD533C5A29F7C450E2EC6D24E69ACAD6620619541CF43B82FE9
- Validity: 2022-03-17 to 2030-03-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Client_CA_for_WWE_2022.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            03:3e:33:39:29:e0:4b:11:b1:a2:fd:29:30:f5:a5:5c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Mar 17 13:24:41 2022 GMT
            Not After : Mar 15 13:24:40 2030 GMT
        Subject: CN = Atos TrustedRoot Client-CA for WWE 2022, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                87:ED:15:F7:45:7A:E6:50:88:5A:A4:74:5B:5D:97:42:68:0A:54:38
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 30A09C203376CEC8C1545DEAEFD672A67130D9C0744E5A1E188C6517713137C6
    SPKI SHA256: 9340193B125F8CD533C5A29F7C450E2EC6D24E69ACAD6620619541CF43B82FE9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot CodeSign CA 2021

- Subject: commonName=Atos TrustedRoot CodeSign CA 2021, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 612059CF910227ABD6B339251B3641E3
- SHA-256: 0D3D8E182C24639A1B7E9A4C32D6DC49EF621ADFD6747E151E289DD08777E094
- SPKI SHA-256: AD41441BFD818A46F93E6FDB352E912608942B830BFAC51E096A39A9FFEDBBA3
- Validity: 2021-04-14 to 2030-04-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CodeSign_CA_2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:20:59:cf:91:02:27:ab:d6:b3:39:25:1b:36:41:e3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Apr 14 13:18:11 2021 GMT
            Not After : Apr 12 13:18:10 2030 GMT
        Subject: CN = Atos TrustedRoot CodeSign CA 2021, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.2
                  CPS: http://pki.atos.net/Download
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                77:B5:9F:11:DA:CD:58:0C:0E:F5:C0:B1:87:39:93:0B:10:9A:22:6C
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0D3D8E182C24639A1B7E9A4C32D6DC49EF621ADFD6747E151E289DD08777E094
    SPKI SHA256: AD41441BFD818A46F93E6FDB352E912608942B830BFAC51E096A39A9FFEDBBA3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.2
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot CodeSigning-CA 2011

- Subject: commonName=Atos TrustedRoot CodeSigning-CA 2011, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 33455239EC16DD62
- SHA-256: D1E421E74213283E354BFDB1A8A74569A469B2615981029B5EC0ACAE7F1F41FC
- SPKI SHA-256: 1AB2F9B46C91201DF64481E47F877F55D8565C36E2371BAB27C9D20960AE70A0
- Validity: 2011-07-07 to 2021-07-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3694449478054894946 (0x33455239ec16dd62)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jul  7 15:07:05 2011 GMT
            Not After : Jul  4 15:07:05 2021 GMT
        Subject: CN = Atos TrustedRoot CodeSigning-CA 2011, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                15:CE:92:F5:2F:C7:7D:EE:98:2D:E1:14:5A:D8:E1:EF:2D:FA:3B:E3
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D1E421E74213283E354BFDB1A8A74569A469B2615981029B5EC0ACAE7F1F41FC
    SPKI SHA256: 1AB2F9B46C91201DF64481E47F877F55D8565C36E2371BAB27C9D20960AE70A0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- is_expired

### Atos TrustedRoot CodeSigning-CA 2011

- Subject: commonName=Atos TrustedRoot CodeSigning-CA 2011, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 33455239EC16DD62
- SHA-256: FA6AE0F90D11C3482AB73E17CCD6BE9ACDDD0159E8052880AA53EAF5413FF472
- SPKI SHA-256: 1AB2F9B46C91201DF64481E47F877F55D8565C36E2371BAB27C9D20960AE70A0
- Validity: 2011-07-07 to 2021-07-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3694449478054894946 (0x33455239ec16dd62)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jul  7 15:07:05 2011 GMT
            Not After : Jul  4 15:07:05 2021 GMT
        Subject: CN = Atos TrustedRoot CodeSigning-CA 2011, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                15:CE:92:F5:2F:C7:7D:EE:98:2D:E1:14:5A:D8:E1:EF:2D:FA:3B:E3
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:C = DE, O = Atos, CN = Atos TrustedRoot 2011
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FA6AE0F90D11C3482AB73E17CCD6BE9ACDDD0159E8052880AA53EAF5413FF472
    SPKI SHA256: 1AB2F9B46C91201DF64481E47F877F55D8565C36E2371BAB27C9D20960AE70A0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- is_expired

### Atos TrustedRoot CodeSigning-CA 2013

- Subject: commonName=Atos TrustedRoot CodeSigning-CA 2013, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 48D770492DD8318E
- SHA-256: 0A1A5221F38DD458367A20D527DB1880082ACCEEF69A8546FB67D30253F90824
- SPKI SHA-256: A7102BB90B6227868B0F6EC7A8D778A9FBEFD3B3149ECDA36A87926188BA3AB4
- Validity: 2013-05-02 to 2023-04-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CodeSigning_CA_2013.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5248787350327669134 (0x48d770492dd8318e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: May  2 13:28:00 2013 GMT
            Not After : Apr 30 13:28:00 2023 GMT
        Subject: CN = Atos TrustedRoot CodeSigning-CA 2013, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                39:E2:B7:6D:C0:D1:7C:1C:DE:E1:3B:CF:F2:88:9F:FC:AA:73:B1:28
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0A1A5221F38DD458367A20D527DB1880082ACCEEF69A8546FB67D30253F90824
    SPKI SHA256: A7102BB90B6227868B0F6EC7A8D778A9FBEFD3B3149ECDA36A87926188BA3AB4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- is_expired

### Atos TrustedRoot Issuing CA for Primetals 2015

- Subject: commonName=Atos TrustedRoot Issuing CA for Primetals 2015, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 5FAE5CC5633C6A8B
- SHA-256: 574342ADAB4ED79EF7818E8299058E1C071AC0E431FE421CABB62DF4D4E9E4C5
- SPKI SHA-256: 11DEFD1FB5F9BD0BF73D1E7EC823C7E2287326164526503E1EC580FB14FBA802
- Validity: 2015-05-07 to 2025-05-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Issuing_CA_for_Primetals_2015.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6894550082394024587 (0x5fae5cc5633c6a8b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: May  7 13:45:04 2015 GMT
            Not After : May  4 13:45:04 2025 GMT
        Subject: CN = Atos TrustedRoot Issuing CA for Primetals 2015, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                AB:06:E9:7F:39:D7:48:27:AC:7A:15:5F:19:5A:19:63:80:C8:22:89
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 574342ADAB4ED79EF7818E8299058E1C071AC0E431FE421CABB62DF4D4E9E4C5
    SPKI SHA256: 11DEFD1FB5F9BD0BF73D1E7EC823C7E2287326164526503E1EC580FB14FBA802
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- is_expired

### Atos TrustedRoot Issuing CA for WWE 2015

- Subject: commonName=Atos TrustedRoot Issuing CA for WWE 2015, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 63B657962512965C
- SHA-256: 74AFCEECE0731587B45C3CDA7BC210FC917502A323401E932E865BC3D797E7AB
- SPKI SHA-256: 200DF6B4A0B89633407E68B8E12411F7179658D8A93CA8E65268EDCE84FAA646
- Validity: 2015-05-07 to 2025-05-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Issuing_CA_for_WWE_2015.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7185026557894891100 (0x63b657962512965c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: May  7 14:12:24 2015 GMT
            Not After : May  4 14:12:24 2025 GMT
        Subject: CN = Atos TrustedRoot Issuing CA for WWE 2015, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                35:29:81:9F:B8:A8:A1:A4:AA:A3:B8:B8:BE:D6:CE:44:71:84:E2:E1
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 74AFCEECE0731587B45C3CDA7BC210FC917502A323401E932E865BC3D797E7AB
    SPKI SHA256: 200DF6B4A0B89633407E68B8E12411F7179658D8A93CA8E65268EDCE84FAA646
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- is_expired

### Atos TrustedRoot Mailgateway CA 2019

- Subject: commonName=Atos TrustedRoot Mailgateway CA 2019, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 6D5DBE969BF7ECB353
- SHA-256: 6E81509376C93FBCE79472C843A568E883CB5D23ECEEA8299A5CBE9C57BCEE1C
- SPKI SHA-256: 11042449C714EAEF476116106BD66D803960F1D2272DE3F1A5ABAA1F972EDF29
- Validity: 2019-05-08 to 2029-05-05
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Mailgateway_CA_2019.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6d:5d:be:96:9b:f7:ec:b3:53
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: May  8 09:13:16 2019 GMT
            Not After : May  5 09:13:16 2029 GMT
        Subject: CN = Atos TrustedRoot Mailgateway CA 2019, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1
                  CPS: http://pki.atos.net/Download
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                CC:E2:67:38:AD:D9:54:D6:37:37:26:1B:C6:B7:4F:3B:48:D6:99:5C
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6E81509376C93FBCE79472C843A568E883CB5D23ECEEA8299A5CBE9C57BCEE1C
    SPKI SHA256: 11042449C714EAEF476116106BD66D803960F1D2272DE3F1A5ABAA1F972EDF29
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Server CA ECC 2022

- Subject: commonName=Atos TrustedRoot Server CA ECC 2022, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot Root CA ECC TLS 2021, organizationName=Atos, countryName=DE
- Serial: 12627BF28D0E2760616A335883ED8D22
- SHA-256: 9F598AF2CEE0321800BA49ACB9ADD14545C08FFE4A06EFA7A09BC395E36E5C4D
- SPKI SHA-256: F0A116DB7C929BD968EC9EA91AE963289DDC8F03E1B95016C41248C5707C4E01
- Validity: 2022-07-12 to 2032-07-09
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Server_CA_ECC_2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%20Root%20CA%20ECC%20TLS%202021, http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            12:62:7b:f2:8d:0e:27:60:61:6a:33:58:83:ed:8d:22
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: CN = Atos TrustedRoot Root CA ECC TLS 2021, O = Atos, C = DE
        Validity
            Not Before: Jul 12 11:42:02 2022 GMT
            Not After : Jul  9 11:42:01 2032 GMT
        Subject: CN = Atos TrustedRoot Server CA ECC 2022, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                76:28:25:D6:7D:E0:66:9A:7A:09:B2:6A:3B:8E:33:D7:36:D3:4F:A2
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRootRootCAECCTLS2021.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1
                  CPS: http://pki.atos.net/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%20Root%20CA%20ECC%20TLS%202021,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot Root CA ECC TLS 2021, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crl
            X509v3 Subject Key Identifier:
                BA:52:1C:41:D4:1D:3C:FF:E9:E4:17:A2:BB:45:3C:34:0A:B8:7F:86
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 9F598AF2CEE0321800BA49ACB9ADD14545C08FFE4A06EFA7A09BC395E36E5C4D
    SPKI SHA256: F0A116DB7C929BD968EC9EA91AE963289DDC8F03E1B95016C41248C5707C4E01
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRootRootCAECCTLS2021.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%20Root%20CA%20ECC%20TLS%202021, http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Server CA RSA 2022

- Subject: commonName=Atos TrustedRoot Server CA RSA 2022, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot Root CA RSA TLS 2021, organizationName=Atos, countryName=DE
- Serial: 601184662D90881AD358F4EF444F2AEF
- SHA-256: 843103FDC2E04B5115C78CC7C47D802ABEF427216E5BBD0946D105751868C3B5
- SPKI SHA-256: D7E987C3D00704314E39C95E341C5988AF7F5CE1409A83794559082DB062EDBD
- Validity: 2022-07-12 to 2032-07-09
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Server_CA_RSA_2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%20Root%20CA%20RSA%20TLS%202021, http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            60:11:84:66:2d:90:88:1a:d3:58:f4:ef:44:4f:2a:ef
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: CN = Atos TrustedRoot Root CA RSA TLS 2021, O = Atos, C = DE
        Validity
            Not Before: Jul 12 11:42:23 2022 GMT
            Not After : Jul  9 11:42:22 2032 GMT
        Subject: CN = Atos TrustedRoot Server CA RSA 2022, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                74:49:99:D1:FF:B4:7A:68:45:75:C3:7E:B4:DC:CC:CE:39:33:DA:08
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRootRootCARSATLS2021.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1
                  CPS: http://pki.atos.net/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%20Root%20CA%20RSA%20TLS%202021,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot Root CA RSA TLS 2021, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crl
            X509v3 Subject Key Identifier:
                2A:AD:10:86:B7:8D:8D:CF:F1:F6:6D:82:8C:05:DA:EC:91:31:60:D4
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 843103FDC2E04B5115C78CC7C47D802ABEF427216E5BBD0946D105751868C3B5
    SPKI SHA256: D7E987C3D00704314E39C95E341C5988AF7F5CE1409A83794559082DB062EDBD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRootRootCARSATLS2021.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%20Root%20CA%20RSA%20TLS%202021, http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Server-CA 2011

- Subject: commonName=Atos TrustedRoot Server-CA 2011, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 6B5D91BC1361CE75
- SHA-256: 24A96109B6C1E16088609459A0C48D7644A1A1D42644752C12BFD24B4E492411
- SPKI SHA-256: 0F2E3F351F236511BA47D7A77C078956D92860133234E8B7A4039066DF5378AE
- Validity: 2011-07-07 to 2021-07-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.3.4.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7736499971857436277 (0x6b5d91bc1361ce75)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jul  7 15:05:29 2011 GMT
            Not After : Jul  4 15:05:29 2021 GMT
        Subject: CN = Atos TrustedRoot Server-CA 2011, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                EA:F8:DE:41:82:5B:43:70:8B:48:F3:A2:87:FE:56:F0:13:98:F5:DD
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.3.4.1.1
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 24A96109B6C1E16088609459A0C48D7644A1A1D42644752C12BFD24B4E492411
    SPKI SHA256: 0F2E3F351F236511BA47D7A77C078956D92860133234E8B7A4039066DF5378AE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.3.4.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- is_expired

### Atos TrustedRoot Server-CA 2011

- Subject: commonName=Atos TrustedRoot Server-CA 2011, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 6B5D91BC1361CE75
- SHA-256: 737C6F64FC288E8AD66FB4AE1FB6A89335D2141D344F786523FF006D82A56340
- SPKI SHA-256: 0F2E3F351F236511BA47D7A77C078956D92860133234E8B7A4039066DF5378AE
- Validity: 2011-07-07 to 2021-07-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.3.4.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7736499971857436277 (0x6b5d91bc1361ce75)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jul  7 15:05:29 2011 GMT
            Not After : Jul  4 15:05:29 2021 GMT
        Subject: CN = Atos TrustedRoot Server-CA 2011, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                EA:F8:DE:41:82:5B:43:70:8B:48:F3:A2:87:FE:56:F0:13:98:F5:DD
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.3.4.1.1
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:C = DE, O = Atos, CN = Atos TrustedRoot 2011
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 737C6F64FC288E8AD66FB4AE1FB6A89335D2141D344F786523FF006D82A56340
    SPKI SHA256: 0F2E3F351F236511BA47D7A77C078956D92860133234E8B7A4039066DF5378AE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.3.4.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- is_expired

### Atos TrustedRoot Server-CA 2013

- Subject: commonName=Atos TrustedRoot Server-CA 2013, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 30F475A14737C5C4
- SHA-256: AAAFE93E359B149A4C9E0B572D51BF37FDA38A7E9A359BF90359BA9CAA96AADF
- SPKI SHA-256: A1B2DB5FA131588D175E3D76968E3E21372CE6B17B004E9DCE5D97F3A43C1292
- Validity: 2013-05-02 to 2023-04-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Server_CA_2013.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3527573743682962884 (0x30f475a14737c5c4)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: May  2 13:30:07 2013 GMT
            Not After : Apr 30 13:30:07 2023 GMT
        Subject: CN = Atos TrustedRoot Server-CA 2013, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                89:DB:0C:4B:E3:4E:4D:FF:21:2D:0F:E6:23:12:36:22:8E:3E:6F:0C
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AAAFE93E359B149A4C9E0B572D51BF37FDA38A7E9A359BF90359BA9CAA96AADF
    SPKI SHA256: A1B2DB5FA131588D175E3D76968E3E21372CE6B17B004E9DCE5D97F3A43C1292
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- is_expired

### Atos TrustedRoot Server-CA 2017

- Subject: commonName=Atos TrustedRoot Server-CA 2017, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 6FE3C5E41BC63357
- SHA-256: 831D8FE8989520F4CBA62E4063143850AD7E570385B94B8E958DB48993B8677E
- SPKI SHA-256: 09A881F075F3A32C678D8663BF74F209B3BAE1EABD90B40A068EAB1B7DC8D668
- Validity: 2017-09-14 to 2027-09-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 8062505341432509271 (0x6fe3c5e41bc63357)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Sep 14 12:27:34 2017 GMT
            Not After : Sep 12 12:27:34 2027 GMT
        Subject: CN = Atos TrustedRoot Server-CA 2017, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList
            X509v3 Subject Key Identifier:
                EC:CA:1D:A7:3A:EF:21:1F:E2:5B:CF:B0:2E:4E:79:71:40:D0:00:37
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 831D8FE8989520F4CBA62E4063143850AD7E570385B94B8E958DB48993B8677E
    SPKI SHA256: 09A881F075F3A32C678D8663BF74F209B3BAE1EABD90B40A068EAB1B7DC8D668
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- AIA OCSP: -
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl, ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Atos TrustedRoot Server-CA 2019

- Subject: commonName=Atos TrustedRoot Server-CA 2019, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 3D9F9E1BB21B3AAA2F
- SHA-256: 08FD418B118853484FD1B066F1922A80F571D8FFF7268D598B086DF18B580AD8
- SPKI SHA-256: 483F0EDA8942C2A16DDF02FAFE5BC1895CE9AE3532A3BBD6AFB6C84B70776A6F
- Validity: 2019-03-28 to 2029-03-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Server_CA_2019.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3d:9f:9e:1b:b2:1b:3a:aa:2f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Mar 28 11:24:11 2019 GMT
            Not After : Mar 25 11:24:11 2029 GMT
        Subject: CN = Atos TrustedRoot Server-CA 2019, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1
                  CPS: http://pki.atos.net/Download
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                FB:63:CD:16:21:6A:73:DF:5A:CE:F4:2B:A9:FD:AA:26:FE:AB:49:A3
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 08FD418B118853484FD1B066F1922A80F571D8FFF7268D598B086DF18B580AD8
    SPKI SHA256: 483F0EDA8942C2A16DDF02FAFE5BC1895CE9AE3532A3BBD6AFB6C84B70776A6F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Atos TrustedRoot Timestamp CA 2020

- Subject: commonName=Atos TrustedRoot Timestamp CA 2020, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 66F17EC44C4967028266B9A0C6D2BE06
- SHA-256: BF7EADE06B2F845ACE7BD690BC3476D4F9EB770C63F2893A35CD52EFEAED6EA3
- SPKI SHA-256: E55FF4FFE312DB60AD6BFB0D2A3760F72F3CBFD50394D6E0F644B56761603659
- Validity: 2020-09-15 to 2030-09-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Timestamp_CA_2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.5
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            66:f1:7e:c4:4c:49:67:02:82:66:b9:a0:c6:d2:be:06
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Sep 15 12:49:03 2020 GMT
            Not After : Sep 13 12:49:03 2030 GMT
        Subject: CN = Atos TrustedRoot Timestamp CA 2020, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.5
                  CPS: http://pki.atos.net/Download
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                20:12:6B:14:6A:3C:43:49:03:B9:1A:BE:E5:C9:D0:DB:F6:90:9C:B1
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BF7EADE06B2F845ACE7BD690BC3476D4F9EB770C63F2893A35CD52EFEAED6EA3
    SPKI SHA256: E55FF4FFE312DB60AD6BFB0D2A3760F72F3CBFD50394D6E0F644B56761603659
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.5
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA for Atos 2023

- Subject: commonName=Eviden TrustedRoot Client CA for Atos 2023, organizationName=Eviden, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 5FC5AA1AD1A7097CCE5566A3F90F2ED1
- SHA-256: 553C2BBAD2DFC79FDEB5DCEE5293DCA70A102E5D87EDDA806E424634E1FE306E
- SPKI SHA-256: B50EF405750B90612CD46E955E188AA1E2C02F1B8B9D97D98F7746FEC2C69F5B
- Validity: 2023-06-28 to 2030-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_for_Atos_2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5f:c5:aa:1a:d1:a7:09:7c:ce:55:66:a3:f9:0f:2e:d1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jun 28 11:46:15 2023 GMT
            Not After : Dec 31 23:59:59 2030 GMT
        Subject: CN = Eviden TrustedRoot Client CA for Atos 2023, O = Eviden, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/Download
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
            X509v3 Subject Key Identifier:
                62:9B:4F:41:40:50:3C:8F:22:76:0D:3A:BA:9D:27:24:F1:AF:6A:FC
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 553C2BBAD2DFC79FDEB5DCEE5293DCA70A102E5D87EDDA806E424634E1FE306E
    SPKI SHA256: B50EF405750B90612CD46E955E188AA1E2C02F1B8B9D97D98F7746FEC2C69F5B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA for Bull 2026

- Subject: commonName=Eviden TrustedRoot Client CA for Bull 2026, organizationName=Eviden Germany GmbH, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 0780F4CD3D0ABA494FAAB0A3242A032E
- SHA-256: 34DA1447BBC58C50093261E8F79A2BB9C2B62062631BB65C39BC9A491C99BEF5
- SPKI SHA-256: 017F770EE910860DD55A38AC89E61CB76D821F9300DE4ABFC869391697B34A43
- Validity: 2026-02-17 to 2030-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_for_Bull_2026.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:80:f4:cd:3d:0a:ba:49:4f:aa:b0:a3:24:2a:03:2e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Feb 17 13:13:49 2026 GMT
            Not After : Dec 31 23:59:59 2030 GMT
        Subject: CN = Eviden TrustedRoot Client CA for Bull 2026, O = Eviden Germany GmbH, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://pki.atos.net/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
            X509v3 Subject Key Identifier:
                A3:B2:87:D1:8B:66:36:C4:0C:D4:52:A6:66:E5:50:A9:ED:80:66:9F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 34DA1447BBC58C50093261E8F79A2BB9C2B62062631BB65C39BC9A491C99BEF5
    SPKI SHA256: 017F770EE910860DD55A38AC89E61CB76D821F9300DE4ABFC869391697B34A43
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA for Bull G2 2026

- Subject: commonName=Eviden TrustedRoot Client CA for Bull G2 2026, organizationName=Eviden Germany GmbH, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 21D4B24E912DD1AFAE6159383D47C48F
- SHA-256: D4E8B47B03E37EAE9466D4C91E24C72589B6493DD1DB93D4EE6703E4DED0E74E
- SPKI SHA-256: 56DAFB845BFEA872F8EE9872A1DEFAFC5637357CEF68B180D36A6D0BEA9606EE
- Validity: 2026-02-19 to 2030-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_for_Bull_G2_2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            21:d4:b2:4e:91:2d:d1:af:ae:61:59:38:3d:47:c4:8f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Feb 19 08:33:16 2026 GMT
            Not After : Dec 31 23:59:59 2030 GMT
        Subject: CN = Eviden TrustedRoot Client CA for Bull G2 2026, O = Eviden Germany GmbH, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                FD:C4:56:30:98:53:8F:12:71:91:2A:5D:BB:AC:A3:00:1F:75:BE:74
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D4E8B47B03E37EAE9466D4C91E24C72589B6493DD1DB93D4EE6703E4DED0E74E
    SPKI SHA256: 56DAFB845BFEA872F8EE9872A1DEFAFC5637357CEF68B180D36A6D0BEA9606EE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA for Elopak 2023

- Subject: commonName=Eviden TrustedRoot Client CA for Elopak 2023, organizationName=Eviden, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 06A51B1AAC5C71F558852A3A141DDD25
- SHA-256: AA17963ADF83409C92762A84FF5ECD4A74F39039F0D769173191CE0DE0215A86
- SPKI SHA-256: C0FE137D2834C82AF811B85088FCD54EB9093FC09B2B2A99A97AD02093BBAA19
- Validity: 2023-06-28 to 2030-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_for_Elopak_2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:a5:1b:1a:ac:5c:71:f5:58:85:2a:3a:14:1d:dd:25
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jun 28 11:49:14 2023 GMT
            Not After : Dec 31 23:59:59 2030 GMT
        Subject: CN = Eviden TrustedRoot Client CA for Elopak 2023, O = Eviden, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/CPS
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
            X509v3 Subject Key Identifier:
                50:D5:69:42:3E:F2:E1:47:3C:D0:EF:E2:E1:AA:B9:E3:F0:CA:E2:91
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AA17963ADF83409C92762A84FF5ECD4A74F39039F0D769173191CE0DE0215A86
    SPKI SHA256: C0FE137D2834C82AF811B85088FCD54EB9093FC09B2B2A99A97AD02093BBAA19
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA for Lilium 2023

- Subject: commonName=Eviden TrustedRoot Client CA for Lilium 2023, organizationName=Eviden, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 19F35EA145DBC02FD630ADC009FC189E
- SHA-256: D82DF73B9B4C240AB93E9D4FDED8F4A4743876F0C82053F84C1A34B03F996306
- SPKI SHA-256: E723A2C456AC00C7DFBE040905984BF948CBDB0FA49041D3BD6C6F8CAA8186FD
- Validity: 2023-06-28 to 2030-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_for_Lilium_2023.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            19:f3:5e:a1:45:db:c0:2f:d6:30:ad:c0:09:fc:18:9e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jun 28 11:45:16 2023 GMT
            Not After : Dec 31 23:59:59 2030 GMT
        Subject: CN = Eviden TrustedRoot Client CA for Lilium 2023, O = Eviden, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/CPS
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
            X509v3 Subject Key Identifier:
                03:F7:64:A4:C0:E7:9B:E1:71:67:61:89:5F:19:98:6E:86:3C:8D:15
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D82DF73B9B4C240AB93E9D4FDED8F4A4743876F0C82053F84C1A34B03F996306
    SPKI SHA256: E723A2C456AC00C7DFBE040905984BF948CBDB0FA49041D3BD6C6F8CAA8186FD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA for NordLB 2023

- Subject: commonName=Eviden TrustedRoot Client CA for NordLB 2023, organizationName=Eviden, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 038BE88303A33782EA602AE5B1A9FF47
- SHA-256: F8A990A525EA9925E4967A5442E9721E4B8D414B001758C128427C0E6D3D2A49
- SPKI SHA-256: 2DD6E12AE83A30E212310A8566656C12CE6C722BDC64F7A7167B45B2E0E3B630
- Validity: 2023-06-28 to 2030-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_for_NordLB_2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            03:8b:e8:83:03:a3:37:82:ea:60:2a:e5:b1:a9:ff:47
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jun 28 11:46:46 2023 GMT
            Not After : Dec 31 23:59:59 2030 GMT
        Subject: CN = Eviden TrustedRoot Client CA for NordLB 2023, O = Eviden, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/Download
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
            X509v3 Subject Key Identifier:
                D3:59:DE:8D:AA:CD:8F:72:C5:9D:EA:53:CF:00:9A:1D:F5:F4:BE:30
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F8A990A525EA9925E4967A5442E9721E4B8D414B001758C128427C0E6D3D2A49
    SPKI SHA256: 2DD6E12AE83A30E212310A8566656C12CE6C722BDC64F7A7167B45B2E0E3B630
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA for Paragon G2 2023

- Subject: commonName=Eviden TrustedRoot Client CA for Paragon G2 2023, organizationName=Eviden, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 7CB896C3E1636D52BE4A89EA3AE805C2
- SHA-256: F2F2ED9E785F1D72B3BFF6DAD1E731FAF1251B0B22E4FB345CEED39FB4B68298
- SPKI SHA-256: 6D1404E49D9BB14DDD0E98CEF3374CB718DF1C7A48DFAC99FF7AAFA629BC34D9
- Validity: 2023-06-28 to 2030-06-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_for_Paragon_G2_2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:b8:96:c3:e1:63:6d:52:be:4a:89:ea:3a:e8:05:c2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jun 28 11:45:02 2023 GMT
            Not After : Jun 26 11:45:01 2030 GMT
        Subject: CN = Eviden TrustedRoot Client CA for Paragon G2 2023, O = Eviden, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/CPS
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
            X509v3 Subject Key Identifier:
                77:50:1D:54:9A:38:93:2C:DB:12:43:78:ED:DA:BB:D3:9C:72:41:5A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F2F2ED9E785F1D72B3BFF6DAD1E731FAF1251B0B22E4FB345CEED39FB4B68298
    SPKI SHA256: 6D1404E49D9BB14DDD0E98CEF3374CB718DF1C7A48DFAC99FF7AAFA629BC34D9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA for Primetals 2023

- Subject: commonName=Eviden TrustedRoot Client CA for Primetals 2023, organizationName=Eviden, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 7744D29C7E6099EFB634F0A282431B8C
- SHA-256: FAA5865F955924828B4984B390086FC944CF359A56DDEF341D66CF88A83F1810
- SPKI SHA-256: 2102F6638A41973BDB6147C04F319E39F0E68435A675763DA079E29538256BD6
- Validity: 2023-06-28 to 2030-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_for_Primetals_2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:44:d2:9c:7e:60:99:ef:b6:34:f0:a2:82:43:1b:8c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jun 28 11:10:34 2023 GMT
            Not After : Dec 31 23:59:59 2030 GMT
        Subject: CN = Eviden TrustedRoot Client CA for Primetals 2023, O = Eviden, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/CPS
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
            X509v3 Subject Key Identifier:
                DA:FD:E3:0C:3C:2B:FD:24:25:94:AE:F5:87:48:18:86:7A:2F:49:51
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FAA5865F955924828B4984B390086FC944CF359A56DDEF341D66CF88A83F1810
    SPKI SHA256: 2102F6638A41973BDB6147C04F319E39F0E68435A675763DA079E29538256BD6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA for SPIE 2023

- Subject: commonName=Eviden TrustedRoot Client CA for SPIE 2023, organizationName=Eviden, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 52313EC5873E6BADB69F161833414800
- SHA-256: 2EAFDB0E7372B59D1C02C86D85B95196AD6B0F50E7814D2B9FDB201F6FA97D7D
- SPKI SHA-256: C9C6CD9E8D4AD46C2ED94F8EE41D977036EFA86F0524695823AC32F91002B514
- Validity: 2023-06-28 to 2030-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_for_SPIE_2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:31:3e:c5:87:3e:6b:ad:b6:9f:16:18:33:41:48:00
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jun 28 11:47:00 2023 GMT
            Not After : Dec 31 23:59:59 2030 GMT
        Subject: CN = Eviden TrustedRoot Client CA for SPIE 2023, O = Eviden, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/CPS
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
            X509v3 Subject Key Identifier:
                10:D6:B1:E7:79:B5:D6:C3:51:21:FD:1D:6B:1E:2D:1A:DB:A1:6C:A8
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2EAFDB0E7372B59D1C02C86D85B95196AD6B0F50E7814D2B9FDB201F6FA97D7D
    SPKI SHA256: C9C6CD9E8D4AD46C2ED94F8EE41D977036EFA86F0524695823AC32F91002B514
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA for SPIE 2026

- Subject: countryName=DE, organizationName=Eviden Germany GmbH, commonName=Eviden TrustedRoot Client CA for SPIE 2026
- Issuer: countryName=DE, organizationName=Atos, commonName=Atos TrustedRoot Root CA RSA G2 2020
- Serial: 20727E1752EA81FCA9E9098C
- SHA-256: CCC8432631B51496EBB85B57CCA025818B145ABF4F57348F7480BF9040BEE9F3
- SPKI SHA-256: B3A432B8D62845682AF158993F62E2E97224C91E186CE2576130109410423E59
- Validity: 2026-02-17 to 2036-02-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_for_SPIE_2026.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_G2_2020.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            20:72:7e:17:52:ea:81:fc:a9:e9:09:8c
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Atos, CN = Atos TrustedRoot Root CA RSA G2 2020
        Validity
            Not Before: Feb 17 13:21:37 2026 GMT
            Not After : Feb 15 13:21:36 2036 GMT
        Subject: C = DE, O = Eviden Germany GmbH, CN = Eviden TrustedRoot Client CA for SPIE 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                20:25:F3:07:FD:A7:6F:F1:96:EE:91:10:69:CC:9A:EF:7D:C8:68:78
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRootRootCARSAG22020.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://pki.atos.net/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_G2_2020.crl                CRL Issuer:
                  DirName:CN = Atos TrustedRoot Root CA RSA G2 2020, O = Atos, C = DE
            X509v3 Subject Key Identifier:
                EC:FC:FD:55:A8:1A:FA:DA:60:E8:42:6E:18:3A:5F:DA:6B:16:28:69
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: CCC8432631B51496EBB85B57CCA025818B145ABF4F57348F7480BF9040BEE9F3
    SPKI SHA256: B3A432B8D62845682AF158993F62E2E97224C91E186CE2576130109410423E59
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRootRootCARSAG22020.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_G2_2020.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA for SPIE G2 2026

- Subject: countryName=DE, organizationName=Eviden Germany GmbH, commonName=Eviden TrustedRoot Client CA for SPIE G2 2026
- Issuer: countryName=DE, organizationName=Atos, commonName=Atos TrustedRoot Root CA RSA G2 2020
- Serial: 2185D48A1A037AFE4B8A09D1
- SHA-256: FA4CBEC7A39681457460CBFDC513DB0B397E55E7CBD68D6C76521B5D99D4B76D
- SPKI SHA-256: DEF69C5DC851235AAB1C17E020C2CBB68F1B2B788D539C66BAE5F39AB8BC595D
- Validity: 2026-02-19 to 2036-02-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_for_SPIE_G2_2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_G2_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            21:85:d4:8a:1a:03:7a:fe:4b:8a:09:d1
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Atos, CN = Atos TrustedRoot Root CA RSA G2 2020
        Validity
            Not Before: Feb 19 08:36:32 2026 GMT
            Not After : Feb 17 08:36:31 2036 GMT
        Subject: C = DE, O = Eviden Germany GmbH, CN = Eviden TrustedRoot Client CA for SPIE G2 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                20:25:F3:07:FD:A7:6F:F1:96:EE:91:10:69:CC:9A:EF:7D:C8:68:78
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRootRootCARSAG22020.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_G2_2020.crl
            X509v3 Subject Key Identifier:
                D9:C9:0F:B6:7C:37:86:67:C0:F3:49:01:8D:DC:0B:BC:71:7A:9A:A4
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: FA4CBEC7A39681457460CBFDC513DB0B397E55E7CBD68D6C76521B5D99D4B76D
    SPKI SHA256: DEF69C5DC851235AAB1C17E020C2CBB68F1B2B788D539C66BAE5F39AB8BC595D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRootRootCARSAG22020.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_G2_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA for Wintershall Dea 2023

- Subject: commonName=Eviden TrustedRoot Client CA for Wintershall Dea 2023, organizationName=Eviden, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 59A697E13A9CBA80DFCD65400B51F88C
- SHA-256: 56F8D11760892DDCC28FD08965510D12F98E80C69096BC351A034AFD8D1046BE
- SPKI SHA-256: 528D6A3CD35F0363D2B83314C4965D23BD9203588D5944028640B50821874FE0
- Validity: 2023-07-03 to 2030-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_for_Wintershall_Dea_2023.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            59:a6:97:e1:3a:9c:ba:80:df:cd:65:40:0b:51:f8:8c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jul  3 08:18:55 2023 GMT
            Not After : Dec 31 23:59:59 2030 GMT
        Subject: CN = Eviden TrustedRoot Client CA for Wintershall Dea 2023, O = Eviden, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/Download
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
            X509v3 Subject Key Identifier:
                45:5D:87:27:4B:CD:AA:EA:7F:41:8B:D9:B1:93:32:62:DE:12:52:5B
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 56F8D11760892DDCC28FD08965510D12F98E80C69096BC351A034AFD8D1046BE
    SPKI SHA256: 528D6A3CD35F0363D2B83314C4965D23BD9203588D5944028640B50821874FE0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA for Wintershall Dea 2023

- Subject: commonName=Eviden TrustedRoot Client CA for Wintershall Dea 2023, organizationName=Eviden, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 09C84EE2D35A5CC464B6D3026A803C6F
- SHA-256: 214FE50E152F0F865AC2F3F4A86F4A199BBA2F832B681B37E425A050D5F9F64B
- SPKI SHA-256: 74EFD6DDC0F5114CDA6B9C32110237F0E29DE0A72ECB2873723289AD284911DB
- Validity: 2023-06-28 to 2030-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            09:c8:4e:e2:d3:5a:5c:c4:64:b6:d3:02:6a:80:3c:6f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jun 28 11:45:58 2023 GMT
            Not After : Dec 31 23:59:59 2030 GMT
        Subject: CN = Eviden TrustedRoot Client CA for Wintershall Dea 2023, O = Eviden, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/Download
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
            X509v3 Subject Key Identifier:
                81:6C:3D:05:74:47:3F:56:77:94:04:96:A9:CF:3E:A5:E7:F3:47:C6
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 214FE50E152F0F865AC2F3F4A86F4A199BBA2F832B681B37E425A050D5F9F64B
    SPKI SHA256: 74EFD6DDC0F5114CDA6B9C32110237F0E29DE0A72ECB2873723289AD284911DB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA for Wintershall Dea G2 2023

- Subject: commonName=Eviden TrustedRoot Client CA for Wintershall Dea G2 2023, organizationName=Eviden, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 60D36D7E3B45EA6D8C38DDFE9438BEE2
- SHA-256: 48C46DA4E9A6490B3067CD79A2483E92777A41DA88C77BE5006D341CF90422A2
- SPKI SHA-256: 3E7C13C4446281DCA6DDF97980E41F90AF35ED4BF3B3DA1032AC7AD68384AE8B
- Validity: 2023-08-30 to 2030-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_for_Wintershall_Dea_G2_2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            60:d3:6d:7e:3b:45:ea:6d:8c:38:dd:fe:94:38:be:e2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Aug 30 08:08:06 2023 GMT
            Not After : Dec 31 23:59:59 2030 GMT
        Subject: CN = Eviden TrustedRoot Client CA for Wintershall Dea G2 2023, O = Eviden, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/Download
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
            X509v3 Subject Key Identifier:
                27:F5:5C:43:58:DB:1B:13:A5:F2:ED:18:19:1A:90:C5:03:AE:D1:58
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 48C46DA4E9A6490B3067CD79A2483E92777A41DA88C77BE5006D341CF90422A2
    SPKI SHA256: 3E7C13C4446281DCA6DDF97980E41F90AF35ED4BF3B3DA1032AC7AD68384AE8B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA for Worldline 2023

- Subject: commonName=Eviden TrustedRoot Client CA for Worldline 2023, organizationName=Eviden, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 3ECE5B7106635113E77666EB15EE4A7C
- SHA-256: B22E9C1159C60FF147A9A4192A834E9170EB845BB4EA169393BD701B38495E63
- SPKI SHA-256: DEC3C7C18E554F68EB4A899FE319F9A0C96781DC3DA14369492D3AD191581C74
- Validity: 2023-06-28 to 2030-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_for_Worldline_2023.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3e:ce:5b:71:06:63:51:13:e7:76:66:eb:15:ee:4a:7c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jun 28 11:47:14 2023 GMT
            Not After : Dec 31 23:59:59 2030 GMT
        Subject: CN = Eviden TrustedRoot Client CA for Worldline 2023, O = Eviden, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/Download
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
            X509v3 Subject Key Identifier:
                0B:40:DA:BC:72:25:AC:0F:BE:91:75:77:8C:8A:8F:B2:6D:22:07:7E
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B22E9C1159C60FF147A9A4192A834E9170EB845BB4EA169393BD701B38495E63
    SPKI SHA256: DEC3C7C18E554F68EB4A899FE319F9A0C96781DC3DA14369492D3AD191581C74
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA for WWE 2023

- Subject: commonName=Eviden TrustedRoot Client CA for WWE 2023, organizationName=Eviden, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 58ACEACC84DBEE9F68299824A385715D
- SHA-256: 8E93AF18003558443867000712DB0240DEC16A154270CEDE6E66B47184218069
- SPKI SHA-256: D73DCE3C0DDD0EEFAF9DF4C3F2E1C08112AF01632D25135D95617B031F4B0D6C
- Validity: 2023-06-28 to 2030-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            58:ac:ea:cc:84:db:ee:9f:68:29:98:24:a3:85:71:5d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jun 28 11:48:57 2023 GMT
            Not After : Dec 31 23:59:59 2030 GMT
        Subject: CN = Eviden TrustedRoot Client CA for WWE 2023, O = Eviden, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/CPS
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
            X509v3 Subject Key Identifier:
                ED:8B:80:3B:DE:69:62:49:E4:34:0C:FA:59:07:A6:52:34:C1:07:FC
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8E93AF18003558443867000712DB0240DEC16A154270CEDE6E66B47184218069
    SPKI SHA256: D73DCE3C0DDD0EEFAF9DF4C3F2E1C08112AF01632D25135D95617B031F4B0D6C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA for WWE G2 2023

- Subject: commonName=Eviden TrustedRoot Client CA for WWE G2 2023, organizationName=Eviden, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 24739793134ACE3977307001CE5C97C2
- SHA-256: 74F109D33E3EE1ED12FFF587F6A119A62591A4F7C15E74047FF9495722B39ACA
- SPKI SHA-256: 136E03E74F848FF1C40C4F3CAC8807C2C87DC3BBB0ABA897C498E22ED392FC78
- Validity: 2023-07-03 to 2030-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_for_WWE_G2_2023.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            24:73:97:93:13:4a:ce:39:77:30:70:01:ce:5c:97:c2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jul  3 08:27:37 2023 GMT
            Not After : Dec 31 23:59:59 2030 GMT
        Subject: CN = Eviden TrustedRoot Client CA for WWE G2 2023, O = Eviden, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/CPS
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
            X509v3 Subject Key Identifier:
                DD:A5:3B:2E:20:04:5F:BB:3A:E0:F7:E4:B7:47:84:06:4A:10:7B:9F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 74F109D33E3EE1ED12FFF587F6A119A62591A4F7C15E74047FF9495722B39ACA
    SPKI SHA256: 136E03E74F848FF1C40C4F3CAC8807C2C87DC3BBB0ABA897C498E22ED392FC78
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA SMIME RSA 2025

- Subject: countryName=DE, organizationName=Eviden Germany GmbH, commonName=Eviden TrustedRoot Client CA SMIME RSA 2025
- Issuer: countryName=DE, organizationName=Atos, commonName=Atos TrustedRoot Root CA RSA G2 2020
- Serial: 7A4D3A59539AEAF94F1F91CF
- SHA-256: 9716C4BC97ED7356C8C3FBF831F9DD995AAFC41527C0A4FD67FCF47255A1E61A
- SPKI SHA-256: CBD6D30B24C37A2DA3F05AF4F7CEA79D5BA6F47A3EF7D205D47C654A366B02F8
- Validity: 2025-08-11 to 2035-08-09
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_SMIME_RSA_2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1.1, 2.23.140.1.5.1.2, 2.23.140.1.5.1.3, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_G2_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:4d:3a:59:53:9a:ea:f9:4f:1f:91:cf
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Atos, CN = Atos TrustedRoot Root CA RSA G2 2020
        Validity
            Not Before: Aug 11 11:26:25 2025 GMT
            Not After : Aug  9 11:26:24 2035 GMT
        Subject: C = DE, O = Eviden Germany GmbH, CN = Eviden TrustedRoot Client CA SMIME RSA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                20:25:F3:07:FD:A7:6F:F1:96:EE:91:10:69:CC:9A:EF:7D:C8:68:78
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRootRootCARSAG22020.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1.1
                Policy: 2.23.140.1.5.1.2
                Policy: 2.23.140.1.5.1.3
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_G2_2020.crl
            X509v3 Subject Key Identifier:
                9B:13:B4:A4:3E:4F:E9:D3:B3:55:20:C1:D2:76:8A:A3:E4:2F:7B:D8
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 9716C4BC97ED7356C8C3FBF831F9DD995AAFC41527C0A4FD67FCF47255A1E61A
    SPKI SHA256: CBD6D30B24C37A2DA3F05AF4F7CEA79D5BA6F47A3EF7D205D47C654A366B02F8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1.1, 2.23.140.1.5.1.2, 2.23.140.1.5.1.3, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRootRootCARSAG22020.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_G2_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_mailbox_validated_allowed_subjectdn_attributes: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA SMIME RSA 2026

- Subject: countryName=DE, organizationName=Eviden Germany GmbH, commonName=Eviden TrustedRoot Client CA SMIME RSA 2026
- Issuer: countryName=DE, organizationName=Atos, commonName=Atos TrustedRoot Root CA RSA G2 2020
- Serial: 409D928110D20BB481DB4FD0
- SHA-256: CF51838A16A03054B21178431D4F2CD94CD4AC60657A4C3E08F0D6F697E7FBFD
- SPKI SHA-256: DA503F6FF4228C1F0A80A1F6AF641AF5F580A8EF5D5A3FFCFD2CCD0B337DD99A
- Validity: 2026-02-17 to 2036-02-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_SMIME_RSA_2026.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_G2_2020.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            40:9d:92:81:10:d2:0b:b4:81:db:4f:d0
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Atos, CN = Atos TrustedRoot Root CA RSA G2 2020
        Validity
            Not Before: Feb 17 13:25:24 2026 GMT
            Not After : Feb 15 13:25:23 2036 GMT
        Subject: C = DE, O = Eviden Germany GmbH, CN = Eviden TrustedRoot Client CA SMIME RSA 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                20:25:F3:07:FD:A7:6F:F1:96:EE:91:10:69:CC:9A:EF:7D:C8:68:78
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRootRootCARSAG22020.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://pki.atos.net/CPS
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_G2_2020.crl                CRL Issuer:
                  DirName:CN = Atos TrustedRoot Root CA RSA G2 2020, O = Atos, C = DE
            X509v3 Subject Key Identifier:
                6E:E1:BD:D4:20:C9:81:B2:C6:75:F1:A2:72:FA:42:6F:37:95:75:3A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: CF51838A16A03054B21178431D4F2CD94CD4AC60657A4C3E08F0D6F697E7FBFD
    SPKI SHA256: DA503F6FF4228C1F0A80A1F6AF641AF5F580A8EF5D5A3FFCFD2CCD0B337DD99A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRootRootCARSAG22020.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_G2_2020.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client CA SMIME RSA G2 2026

- Subject: countryName=DE, organizationName=Eviden Germany GmbH, commonName=Eviden TrustedRoot Client CA SMIME RSA G2 2026
- Issuer: countryName=DE, organizationName=Atos, commonName=Atos TrustedRoot Root CA RSA G2 2020
- Serial: 2DCCDF818F1CAF679EC667AB
- SHA-256: F1FA1D257B704533F25ED46D2CFCFE9007FC88535E972FDF8E5A8B5158529517
- SPKI SHA-256: 76FD3F82D7C2BFE37A2E86FBF413C13F48401D08BEBA15B13601C635973557BE
- Validity: 2026-02-19 to 2036-02-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_SMIME_RSA_G2_2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_G2_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2d:cc:df:81:8f:1c:af:67:9e:c6:67:ab
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = Atos, CN = Atos TrustedRoot Root CA RSA G2 2020
        Validity
            Not Before: Feb 19 08:43:06 2026 GMT
            Not After : Feb 17 08:43:05 2036 GMT
        Subject: C = DE, O = Eviden Germany GmbH, CN = Eviden TrustedRoot Client CA SMIME RSA G2 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                20:25:F3:07:FD:A7:6F:F1:96:EE:91:10:69:CC:9A:EF:7D:C8:68:78
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRootRootCARSAG22020.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_G2_2020.crl
            X509v3 Subject Key Identifier:
                57:13:EC:C3:7B:65:F6:63:35:B7:E9:53:B8:E7:E5:9C:B9:FF:BB:3A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: F1FA1D257B704533F25ED46D2CFCFE9007FC88535E972FDF8E5A8B5158529517
    SPKI SHA256: 76FD3F82D7C2BFE37A2E86FBF413C13F48401D08BEBA15B13601C635973557BE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRootRootCARSAG22020.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_Root_CA_RSA_G2_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client-CA 2023

- Subject: commonName=Eviden TrustedRoot Client-CA 2023, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 6625FF46523281B24C85AFAD0AD7E9CF
- SHA-256: 5CE3649AECD3F7A9885E7DD6C1434A663A5131CB6315B59D1ADDFD44A75D475E
- SPKI SHA-256: 4DCAFE4ED4D3A6628EE7B04BBF85E0BAC700EFD651ED049E536DBC7D760D879A
- Validity: 2023-04-04 to 2030-04-02
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_2023.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            66:25:ff:46:52:32:81:b2:4c:85:af:ad:0a:d7:e9:cf
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Apr  4 11:49:43 2023 GMT
            Not After : Apr  2 11:49:42 2030 GMT
        Subject: CN = Eviden TrustedRoot Client-CA 2023, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/CPS
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                C9:BA:3C:A1:C0:91:F5:0C:0E:7F:DC:2A:10:37:30:9A:5F:9B:F7:62
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5CE3649AECD3F7A9885E7DD6C1434A663A5131CB6315B59D1ADDFD44A75D475E
    SPKI SHA256: 4DCAFE4ED4D3A6628EE7B04BBF85E0BAC700EFD651ED049E536DBC7D760D879A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Client-CA G2 2023

- Subject: commonName=Eviden TrustedRoot Client-CA G2 2023, organizationName=Atos, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 6E756AEC68CCCF03E8F406BB9A52F034
- SHA-256: CE8556B2E0E76EF602D44D8187F534E071677C6BF98E76563FE789A87BEBA709
- SPKI SHA-256: 6ECACEFAA5DB813D9F8A54DBFB0B077E4AF2B57B0C2CC15BE9388A0865154020
- Validity: 2023-05-03 to 2030-05-01
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Eviden_TrustedRoot_Client_CA_G2_2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 2.23.140.1.5.3.1, 2.23.140.1.5.2.3, 2.23.140.1.5.2.2, 2.23.140.1.5.2.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6e:75:6a:ec:68:cc:cf:03:e8:f4:06:bb:9a:52:f0:34
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: May  3 11:12:20 2023 GMT
            Not After : May  1 11:12:19 2030 GMT
        Subject: CN = Eviden TrustedRoot Client-CA G2 2023, O = Atos, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/CPS
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.1
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011,ou=CA,ou=Atos%20TC,o=Atos,dc=atos,dc=net?certificateRevocationList                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
            X509v3 Subject Key Identifier:
                F4:C8:8E:59:C7:E6:B5:96:11:61:EA:93:38:26:07:31:36:7D:EA:79
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CE8556B2E0E76EF602D44D8187F534E071677C6BF98E76563FE789A87BEBA709
    SPKI SHA256: 6ECACEFAA5DB813D9F8A54DBFB0B077E4AF2B57B0C2CC15BE9388A0865154020
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 2.23.140.1.5.3.1, 2.23.140.1.5.2.3, 2.23.140.1.5.2.2, 2.23.140.1.5.2.1
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: ldap://pki-ldap.atos.net/cn=Atos%20TrustedRoot%202011, http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Mailgateway CA 2023

- Subject: commonName=Eviden TrustedRoot Mailgateway CA 2023, organizationName=Eviden, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 6E1C43BFC3B117170D65B662F86510DC
- SHA-256: 79E7FC6A9BBB9778F2A1F09B4E9431BB351D136078A23465D70FA66491FC7C1B
- SPKI SHA-256: B490E963769DFF652403339498BCEA50180DCE2E2CA52C62F16007735C062018
- Validity: 2023-06-28 to 2030-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6e:1c:43:bf:c3:b1:17:17:0d:65:b6:62:f8:65:10:dc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jun 28 11:46:31 2023 GMT
            Not After : Dec 31 23:59:59 2030 GMT
        Subject: CN = Eviden TrustedRoot Mailgateway CA 2023, O = Eviden, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/Download
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
            X509v3 Subject Key Identifier:
                B4:06:3A:A7:3F:52:B3:BB:F4:12:78:A9:9F:B7:01:50:86:F3:DA:12
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 79E7FC6A9BBB9778F2A1F09B4E9431BB351D136078A23465D70FA66491FC7C1B
    SPKI SHA256: B490E963769DFF652403339498BCEA50180DCE2E2CA52C62F16007735C062018
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.4.1, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Eviden TrustedRoot Mailgateway CA G2 2023

- Subject: commonName=Eviden TrustedRoot Mailgateway CA G2 2023, organizationName=Eviden, countryName=DE
- Issuer: commonName=Atos TrustedRoot 2011, organizationName=Atos, countryName=DE
- Serial: 73760139F0BFFE1172871DC2C7517A4D
- SHA-256: BA71F25B775BEAA94534142ACB958604D63D29847B038C48575DD41C270F9876
- SPKI SHA-256: 3B2BB95FAB5C51879E6AFB541D7BFAC64874793CF35644D7F0A4227CFA9DCABE
- Validity: 2023-07-03 to 2030-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://pki-crl.atos.net/crl/Eviden_TrustedRoot_Mailgateway_CA_G2_2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://pki-ocsp.atos.net
- CRL DP: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            73:76:01:39:f0:bf:fe:11:72:87:1d:c2:c7:51:7a:4d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Atos TrustedRoot 2011, O = Atos, C = DE
        Validity
            Not Before: Jul  3 08:24:49 2023 GMT
            Not After : Dec 31 23:59:59 2030 GMT
        Subject: CN = Eviden TrustedRoot Mailgateway CA G2 2023, O = Eviden, C = DE
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A7:A5:06:B1:2C:A6:09:60:EE:D1:97:E9:70:AE:BC:3B:19:6C:DB:21
            Authority Information Access:
                CA Issuers - URI:http://pki.atos.net/Download/AtosTrustedRoot2011.cer
                OCSP - URI:http://pki-ocsp.atos.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.6189.5.1.1.1.1
                  CPS: http://pki.atos.net/Download
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crl                CRL Issuer:
                  DirName:CN = Atos TrustedRoot 2011, O = Atos, C = DE
            X509v3 Subject Key Identifier:
                FB:03:B6:FB:15:D2:09:31:87:07:75:CF:DE:86:41:81:B7:D0:EE:C2
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BA71F25B775BEAA94534142ACB958604D63D29847B038C48575DD41C270F9876
    SPKI SHA256: 3B2BB95FAB5C51879E6AFB541D7BFAC64874793CF35644D7F0A4227CFA9DCABE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.6189.5.1.1.1.1, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3
- AIA OCSP: http://pki-ocsp.atos.net
- AIA CA Issuers: http://pki.atos.net/Download/AtosTrustedRoot2011.cer
- CRL Distribution Points: http://pki-crl.atos.net/crl/Atos_TrustedRoot_CA_2011.crlCRL
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
