# CA Owner Audit Dump - D-TRUST

Generated: 2026-07-28T08:33:46.095082Z

## CA Owner Summary

- Name: D-TRUST
- Country: Germany
- Website: -
- Problem Reporting: https://www.d-trust.net/en/support/reporting-certificate-problem
- CP/CPS URLs: https://www1.d-trust.net/pdf-download/D-TRUST_CP_v6.0.pdf, https://www.d-trust.net/pdf-download/D-TRUST_CP_v5.8.pdf, https://www1.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.3.pdf, https://www.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.1.pdf, https://www1.d-trust.net/pdf-download/EON_SE_PKI_CPS_v3.6.pdf, https://www1.d-trust.net/pdf-download/D-TRUST_Cloud_PKI_CPS_v4.3.pdf, https://www.d-trust.net/internet/files/D-TRUST_CP.pdf, https://www.d-trust.net/internet/files/D-TRUST_CSM_PKI_CPS.pdf, https://www.d-trust.net/internet/files/D-TRUST_Root_PKI_CPS.pdf, https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf, http://www.d-trust.net/internet/files/D-TRUST_Cloud_PKI_CPS.pdf, http://www.d-trust.net/internet/files/D-TRUST_CP.pdf, http://www.d-trust.net/internet/files/D-TRUST_CSM_PKI_CPS.pdf, http://www.d-trust.net/internet/files/UNIPER_PKI_CPS.pdf
- Audit URLs: https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_Standard_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_TLS-BR_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_TLS-EV_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_SMIME-BR_Audit_V1.1.pdf
- Root Programs: {"mozilla":"Included","chrome":"Included","microsoft":"Included","apple":"Not Included"}

## Owner Disclosure Snapshot

- Problem reporting mechanism: https://www.d-trust.net/en/support/reporting-certificate-problem
- CP/CPS URLs: https://www1.d-trust.net/pdf-download/D-TRUST_CP_v6.0.pdf, https://www.d-trust.net/pdf-download/D-TRUST_CP_v5.8.pdf, https://www1.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.3.pdf, https://www.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.1.pdf, https://www1.d-trust.net/pdf-download/EON_SE_PKI_CPS_v3.6.pdf, https://www1.d-trust.net/pdf-download/D-TRUST_Cloud_PKI_CPS_v4.3.pdf, https://www.d-trust.net/internet/files/D-TRUST_CP.pdf, https://www.d-trust.net/internet/files/D-TRUST_CSM_PKI_CPS.pdf, https://www.d-trust.net/internet/files/D-TRUST_Root_PKI_CPS.pdf, https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf, http://www.d-trust.net/internet/files/D-TRUST_Cloud_PKI_CPS.pdf, http://www.d-trust.net/internet/files/D-TRUST_CP.pdf, http://www.d-trust.net/internet/files/D-TRUST_CSM_PKI_CPS.pdf, http://www.d-trust.net/internet/files/UNIPER_PKI_CPS.pdf
- Audit URLs: https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_Standard_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_TLS-BR_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_TLS-EV_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_SMIME-BR_Audit_V1.1.pdf
- Repository URLs: https://www.bundesdruckerei.de/en/Repository, https://www.d-trust.net/en/support/repository
- Root programs: {"mozilla":"Included","chrome":"Included","microsoft":"Included","apple":"Not Included"}
- Contact aliases: -

## Certificate Inventory

| # | Subject | CA | Lifecycle | Validity | Policies | pathLen | EKU | zlint |
|---|---|---|---|---|---|---|---|---|
| 1 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR Root CA 1 2020 | yes | unknown | 2020-02-11 to 2035-02-11 | - | - | - | clean |
| 2 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR Root CA 2 2023 | yes | unknown | 2023-05-09 to 2038-05-09 | - | - | - | clean |
| 3 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 1 2020 | yes | unknown | 2020-02-11 to 2035-02-11 | - | - | - | clean |
| 4 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 2 2023 | yes | unknown | 2023-05-09 to 2038-05-09 | - | - | - | clean |
| 5 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Qualified Root CA 1 2007:PN | yes | expired | 2007-06-08 to 2012-06-08 | 1.3.6.1.4.1.4788.2.31.1 | - | - | clean |
| 6 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root CA 3 2013 | yes | unknown | 2013-09-20 to 2028-09-20 | - | - | - | clean |
| 7 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 2 CA 2007 | yes | expired | 2007-05-16 to 2022-05-16 | - | - | - | clean |
| 8 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 3 CA 2 2009 | yes | unknown | 2009-11-05 to 2029-11-05 | - | - | - | clean |
| 9 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 3 CA 2 EV 2009 | yes | unknown | 2009-11-05 to 2029-11-05 | - | - | - | clean |
| 10 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 3 CA 2007 | yes | expired | 2007-05-16 to 2022-05-16 | - | - | - | clean |
| 11 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 1 2022 | yes | unknown | 2022-07-06 to 2037-07-06 | - | - | - | clean |
| 12 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 2 2022 | yes | unknown | 2022-07-07 to 2037-07-07 | - | - | - | clean |
| 13 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Application Certificates CA 3-1 2013 | yes | current | 2013-09-27 to 2028-09-20 | 1.3.6.1.4.1.4788.2.200.1 | 0 | - | current errors: 1 |
| 14 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Application Certificates CA 3-1 2013 | yes | current | 2024-07-11 to 2028-09-20 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.4.1, 2.23.140.1.5.4.2, 2.23.140.1.5.4.3, 1.3.6.1.4.1.4788.2.200.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 15 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Application Certificates CA 3-1 2013 | yes | current | 2024-05-15 to 2028-09-20 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.4.1, 2.23.140.1.5.4.2, 2.23.140.1.5.4.3, 1.3.6.1.4.1.4788.2.200.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 16 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Application Certificates CA 3-2 2016, organizationIdentifier=NTRDE-HRB74346 | yes | current | 2016-11-16 to 2028-09-20 | 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2 | 0 | - | clean |
| 17 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR CA 1-20-1 2020 | yes | current | 2020-11-24 to 2035-02-11 | 1.3.6.1.4.1.4788.2.202.2, 0.4.0.2042.1.7, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 18 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR CA 1-20-2 2020 | yes | current | 2020-11-24 to 2035-02-11 | 1.3.6.1.4.1.4788.2.202.3, 0.4.0.2042.1.6, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 19 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR CA 2-23-1 2023 | yes | current | 2023-05-11 to 2038-05-09 | 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 20 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR CA 2-23-2 2023 | yes | current | 2023-05-11 to 2038-05-09 | 2.23.140.1.2.1, 0.4.0.2042.1.6, 1.3.6.1.4.1.4788.2.202.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 21 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR EV CA 1-20-3 2025 | yes | current | 2025-10-02 to 2035-02-11 | 2.23.140.1.1, 0.4.0.2042.1.4, 1.3.6.1.4.1.4788.2.202.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 22 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR EV CA 2-23-3 2025 | yes | current | 2025-10-02 to 2038-05-09 | 2.23.140.1.1, 0.4.0.2042.1.4, 1.3.6.1.4.1.4788.2.202.1 | 0 | TLS Web Server Authentication | clean |
| 23 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR Root CA 1 2020 | yes | current | 2025-07-14 to 2029-11-05 | 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.1, 0.4.0.2042.1.6, 0.4.0.2042.1.7, 0.4.0.2042.1.4, 0.4.0.194112.1.4, 1.3.6.1.4.1.4788.2.202.3, 1.3.6.1.4.1.4788.2.202.2, 1.3.6.1.4.1.4788.2.202.1, 1.3.6.1.4.1.4788.2.150.4 | - | TLS Web Server Authentication | current errors: 2 |
| 24 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR Root CA 2 2023 | yes | current | 2025-07-14 to 2029-11-05 | 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.1, 0.4.0.2042.1.6, 0.4.0.2042.1.7, 0.4.0.2042.1.4, 0.4.0.194112.1.4, 1.3.6.1.4.1.4788.2.202.3, 1.3.6.1.4.1.4788.2.202.2, 1.3.6.1.4.1.4788.2.202.1, 1.3.6.1.4.1.4788.2.150.4 | - | TLS Web Server Authentication | current errors: 1 |
| 25 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST CA 2-2 EV 2016, organizationIdentifier=NTRDE-HRB74346 | yes | current | 2016-11-16 to 2029-11-05 | 0.4.0.194112.1.4, 1.3.6.1.4.1.4788.2.150.4, 1.3.6.1.4.1.4788.2.202.1 | 0 | - | clean |
| 26 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV CA 1-20-1 2020 | yes | current | 2020-11-24 to 2035-02-11 | 1.3.6.1.4.1.4788.2.202.1, 0.4.0.2042.1.4, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 27 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV CA 1-20-2 2020 | yes | revoked | 2020-11-24 to 2035-02-11 | 1.3.6.1.4.1.4788.2.202.1, 1.3.6.1.4.1.4788.2.150.4, 0.4.0.194112.1.4, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 28 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV CA 2-23-1 2023 | yes | current | 2023-05-11 to 2038-05-09 | 2.23.140.1.1, 0.4.0.2042.1.4, 1.3.6.1.4.1.4788.2.202.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 29 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV CA 2-23-2 2023, organizationIdentifier=VATDE-202620438 | yes | revoked | 2023-05-11 to 2038-05-09 | 2.23.140.1.1, 0.4.0.194112.1.4, 1.3.6.1.4.1.4788.2.150.4, 1.3.6.1.4.1.4788.2.202.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 30 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 1 2020 | yes | current | 2026-03-25 to 2029-11-05 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 0.4.0.2042.1.4, 0.4.0.2042.1.6, 0.4.0.2042.1.7, 0.4.0.194112.1.4, 1.3.6.1.4.1.4788.2.202.1, 1.3.6.1.4.1.4788.2.202.2, 1.3.6.1.4.1.4788.2.202.3, 1.3.6.1.4.1.4788.2.150.4 | - | TLS Web Server Authentication | current errors: 2 |
| 31 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 2 2023 | yes | current | 2026-03-25 to 2029-11-05 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 0.4.0.2042.1.4, 0.4.0.2042.1.6, 0.4.0.2042.1.7, 0.4.0.194112.1.4, 1.3.6.1.4.1.4788.2.202.1, 1.3.6.1.4.1.4788.2.202.2, 1.3.6.1.4.1.4788.2.202.3, 1.3.6.1.4.1.4788.2.150.4 | - | TLS Web Server Authentication | current errors: 1 |
| 32 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 1-22-1 2022, organizationIdentifier=VATDE-202620438 | yes | current | 2022-07-06 to 2037-07-06 | 2.23.140.1.5.2.3, 2.23.140.1.5.3.3, 2.23.140.1.5.4.3, 0.4.0.2042.1.1, 1.3.6.1.4.1.4788.2.200.3 | 0 | E-mail Protection | clean |
| 33 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 1-22-2 2022, organizationIdentifier=VATDE-202620438 | yes | current | 2022-07-06 to 2037-07-06 | 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.4.1, 2.23.140.1.5.4.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2 | 0 | E-mail Protection | clean |
| 34 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 1-22-3 2023, organizationIdentifier=VATDE-202620438 | yes | current | 2023-05-09 to 2037-07-06 | 2.23.140.1.5.1.1, 2.23.140.1.5.1.2, 2.23.140.1.5.1.3, 1.3.6.1.4.1.4788.2.200.5 | 0 | E-mail Protection | clean |
| 35 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 1-22-4 2024, organizationIdentifier=VATDE-202620438 | yes | current | 2024-05-14 to 2037-07-06 | 2.23.140.1.5.2.2, 2.23.140.1.5.3.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 36 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 1-22-5 2024, organizationIdentifier=VATDE-202620438 | yes | current | 2024-05-14 to 2037-07-06 | 2.23.140.1.5.2.2, 2.23.140.1.5.3.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 37 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 2-22-1 2022, organizationIdentifier=VATDE-202620438 | yes | current | 2022-07-07 to 2037-07-07 | 2.23.140.1.5.2.3, 2.23.140.1.5.3.3, 2.23.140.1.5.4.3, 0.4.0.2042.1.1, 1.3.6.1.4.1.4788.2.200.3 | 0 | E-mail Protection | clean |
| 38 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 2-22-2 2022, organizationIdentifier=VATDE-202620438 | yes | current | 2022-07-07 to 2037-07-07 | 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.4.1, 2.23.140.1.5.4.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2 | 0 | E-mail Protection | clean |
| 39 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 2-22-3 2023, organizationIdentifier=VATDE-202620438 | yes | current | 2023-05-09 to 2037-07-07 | 2.23.140.1.5.1.1, 2.23.140.1.5.1.2, 2.23.140.1.5.1.3, 1.3.6.1.4.1.4788.2.200.5 | 0 | E-mail Protection | clean |
| 40 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 2-22-4 2024, organizationIdentifier=VATDE-202620438 | yes | current | 2024-05-14 to 2037-07-07 | 2.23.140.1.5.2.2, 2.23.140.1.5.3.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 41 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 2-22-5 2024, organizationIdentifier=VATDE-202620438 | yes | current | 2024-05-14 to 2037-07-07 | 2.23.140.1.5.2.2, 2.23.140.1.5.3.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 42 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 2 2022 | yes | current | 2025-07-14 to 2028-09-20 | 2.23.140.1.5.1.2, 2.23.140.1.5.1.3, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 2.23.140.1.5.4.2, 2.23.140.1.5.4.3, 0.4.0.2042.1.1, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2, 1.3.6.1.4.1.4788.2.200.3, 1.3.6.1.4.1.4788.2.200.5 | - | TLS Web Client Authentication, E-mail Protection | current errors: 1 |
| 43 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST SCE384 CA 1-20-31 2026 | yes | current | 2026-06-02 to 2035-02-11 | 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 44 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST SCR4096 CA 2-23-31 2026 | yes | current | 2026-06-02 to 2038-05-09 | 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 45 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST SSL CA 2 2020 | yes | current | 2020-04-21 to 2029-11-05 | 0.4.0.2042.1.6, 1.3.6.1.4.1.4788.2.202.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 46 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST SSL Class 3 CA 1 2009 | yes | current | 2009-11-12 to 2029-11-05 | 2.5.29.32.0 | 0 | - | clean |
| 47 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST SSL Class 3 CA 1 EV 2009 | yes | current | 2009-11-12 to 2029-11-05 | 2.5.29.32.0 | 0 | - | clean |
| 48 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST WE384 CA 1-20-12 2026 | yes | current | 2026-07-17 to 2029-07-16 | 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2 | 0 | TLS Web Server Authentication | not_available |
| 49 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST WE384 CA 1-20-22 2026 | yes | current | 2026-07-17 to 2029-07-16 | 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2 | 0 | TLS Web Server Authentication | not_available |
| 50 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST WR4096 CA 2-23-11 2026 | yes | current | 2026-03-25 to 2029-03-24 | 2.23.140.1.2.1, 0.4.0.2042.1.6, 1.3.6.1.4.1.4788.2.202.3 | 0 | TLS Web Server Authentication | clean |
| 51 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST WR4096 CA 2-23-12 2026 | yes | current | 2026-03-25 to 2029-03-24 | 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2 | 0 | TLS Web Server Authentication | clean |
| 52 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST WR4096 CA 2-23-13 2026 | yes | current | 2026-03-25 to 2029-03-24 | 2.23.140.1.1, 0.4.0.2042.1.4, 1.3.6.1.4.1.4788.2.202.1 | 0 | TLS Web Server Authentication | clean |
| 53 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST WR4096 CA 2-23-21 2026 | yes | current | 2026-04-15 to 2029-04-14 | 2.23.140.1.2.1, 0.4.0.2042.1.6, 1.3.6.1.4.1.4788.2.202.3 | 0 | TLS Web Server Authentication | clean |
| 54 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST WR4096 CA 2-23-22 2026 | yes | current | 2026-04-15 to 2029-04-14 | 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2 | 0 | TLS Web Server Authentication | clean |
| 55 | countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST WR4096 CA 2-23-23 2026 | yes | current | 2026-04-15 to 2029-04-14 | 2.23.140.1.1, 0.4.0.2042.1.4, 1.3.6.1.4.1.4788.2.202.1 | 0 | TLS Web Server Authentication | clean |
| 56 | countryName=DE, organizationName=E.ON SE, organizationalUnitName=CA, commonName=E.ON CA 2 2013 XXI | yes | current | 2024-05-15 to 2028-09-20 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4788.2.210.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 57 | countryName=DE, organizationName=E.ON SE, organizationalUnitName=CA, commonName=E.ON CA 2 2013 XXI | yes | current | 2024-07-11 to 2028-09-20 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4788.2.210.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 58 | countryName=DE, organizationName=E.ON SE, organizationalUnitName=CA, commonName=E.ON CA 2 2013 XXI | yes | current | 2013-12-17 to 2028-09-20 | 1.3.6.1.4.1.4788.2.210.1 | 0 | - | clean |
| 59 | countryName=DE, organizationName=E.ON SE, organizationalUnitName=CA, commonName=E.ON CA 2 2013 XXII | yes | current | 2013-12-17 to 2028-09-20 | 1.3.6.1.4.1.4788.2.210.1 | 0 | - | clean |
| 60 | countryName=DE, organizationName=E.ON SE, organizationalUnitName=CA, commonName=E.ON CA 2 2013 XXIII | yes | current | 2013-12-17 to 2028-09-20 | 1.3.6.1.4.1.4788.2.210.1 | 0 | - | clean |
| 61 | countryName=DE, organizationName=E.ON SE, organizationalUnitName=CA, commonName=E.ON CA 2 2013 XXIII | yes | current | 2024-07-11 to 2028-09-20 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4788.2.210.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 62 | countryName=DE, organizationName=E.ON SE, organizationalUnitName=CA, commonName=E.ON CA 2 2013 XXIII | yes | current | 2024-05-15 to 2028-09-20 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4788.2.210.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 63 | countryName=DE, organizationName=D-Trust GmbH, commonName=E.ON CA 3 2024 XXI, organizationIdentifier=VATDE-202620438 | yes | current | 2024-10-21 to 2036-10-21 | 2.23.140.1.5.3.3, 0.4.0.2042.1.1, 1.3.6.1.4.1.4788.2.210.2 | 0 | E-mail Protection | clean |
| 64 | countryName=DE, organizationName=D-Trust GmbH, commonName=E.ON CA 3 2024 XXIII, organizationIdentifier=VATDE-202620438 | yes | current | 2024-10-21 to 2036-10-21 | 2.23.140.1.5.3.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.210.1 | 0 | E-mail Protection | clean |
| 65 | countryName=DE, organizationName=D-Trust GmbH, commonName=E.ON Group CA 2 2013 | yes | current | 2013-12-17 to 2028-09-20 | 1.3.6.1.4.1.4788.2.200.1 | - | - | clean |
| 66 | countryName=DE, organizationName=D-Trust GmbH, organizationalUnitName=CA, commonName=Partner CA 2 2013 XXIV | yes | current | 2013-12-17 to 2028-09-20 | 1.3.6.1.4.1.4788.2.210.1 | 0 | - | clean |
| 67 | countryName=DE, organizationName=Uniper Holding GmbH, organizationalUnitName=CA, commonName=Uniper CA 2 2015 XXXI | yes | revoked | 2015-11-12 to 2028-09-20 | 1.3.6.1.4.1.4788.2.212.1 | 0 | - | clean |
| 68 | countryName=DE, organizationName=Uniper Holding GmbH, organizationalUnitName=CA, commonName=Uniper CA 2 2015 XXXII | yes | revoked | 2015-11-12 to 2028-09-20 | 1.3.6.1.4.1.4788.2.212.1 | 0 | - | clean |
| 69 | countryName=DE, organizationName=Uniper Holding GmbH, organizationalUnitName=CA, commonName=Uniper CA 2 2015 XXXIII | yes | revoked | 2015-11-12 to 2028-09-20 | 1.3.6.1.4.1.4788.2.212.1 | 0 | - | clean |
| 70 | countryName=DE, organizationName=Uniper Holding GmbH, organizationalUnitName=CA, commonName=Uniper CA 3 2020 XXXI | yes | revoked | 2020-04-21 to 2028-09-20 | 1.3.6.1.4.1.4788.2.212.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 71 | countryName=DE, organizationName=Uniper Holding GmbH, organizationalUnitName=CA, commonName=Uniper CA 3 2020 XXXII | yes | revoked | 2020-04-21 to 2028-09-20 | 1.3.6.1.4.1.4788.2.212.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 72 | countryName=DE, organizationName=Uniper Holding GmbH, organizationalUnitName=CA, commonName=Uniper CA 3 2020 XXXIII | yes | revoked | 2020-04-21 to 2028-09-20 | 1.3.6.1.4.1.4788.2.212.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 73 | countryName=DE, organizationName=D-Trust GmbH, commonName=Uniper Group CA 2 2015 | yes | revoked | 2015-11-12 to 2028-09-20 | 1.3.6.1.4.1.4788.2.212.1 | - | - | clean |
| 74 | countryName=DE, organizationName=D-Trust GmbH, commonName=Uniper Group CA 3 2020 | yes | revoked | 2020-04-21 to 2028-09-20 | 1.3.6.1.4.1.4788.2.212.1 | - | TLS Web Client Authentication, E-mail Protection | clean |
| 75 | countryName=DE, organizationName=D-Trust GmbH, commonName=VR IDENT EV SSL CA 2020 | yes | revoked | 2020-04-21 to 2029-11-05 | 1.3.6.1.4.1.4788.2.230.1, 0.4.0.2042.1.4, 1.3.6.1.4.1.4788.2.202.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 76 | countryName=DE, organizationName=D-Trust GmbH, commonName=VR IDENT SSL CA 2020 | yes | revoked | 2020-04-21 to 2029-11-05 | 1.3.6.1.4.1.4788.2.230.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |

## Certificate Details

### D-TRUST BR Root CA 1 2020

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR Root CA 1 2020
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR Root CA 1 2020
- Serial: 7CC98F2B84D7DFEA0FC9659AD34B4D96
- SHA-256: E59AAA816009C22BFF5B25BAD37DF306F049797C1F81D85AB089E657BD8F0044
- SPKI SHA-256: 603F76F28C9FEBA83EC751EDB66C8D7523EA40FE49FE74427629F50DABBCF55A
- Validity: 2020-02-11 to 2035-02-11
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www1.d-trust.net/pdf-download/D-TRUST_CP_v6.0.pdf; https://www.d-trust.net/pdf-download/D-TRUST_CP_v5.8.pdf, https://www1.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.3.pdf; https://www.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_Standard_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_TLS-BR_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_TLS-EV_Audit_V1.2.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl, ldap://directory.d-trust.net/CN=D-TRUST%20BR%20Root%20CA%201%202020
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:c9:8f:2b:84:d7:df:ea:0f:c9:65:9a:d3:4b:4d:96
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST BR Root CA 1 2020
        Validity
            Not Before: Feb 11 09:45:00 2020 GMT
            Not After : Feb 11 09:44:59 2035 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST BR Root CA 1 2020
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                73:91:10:AB:FF:55:B3:5A:7C:09:25:D5:B2:BA:08:A0:6B:AB:1F:6D
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20BR%20Root%20CA%201%202020,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E59AAA816009C22BFF5B25BAD37DF306F049797C1F81D85AB089E657BD8F0044
    SPKI SHA256: 603F76F28C9FEBA83EC751EDB66C8D7523EA40FE49FE74427629F50DABBCF55A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl, ldap://directory.d-trust.net/CN=D-TRUST%20BR%20Root%20CA%201%202020
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp

### D-TRUST BR Root CA 2 2023

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR Root CA 2 2023
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR Root CA 2 2023
- Serial: 733B3004485BD94D782E734BC9A1DC66
- SHA-256: 0552E6F83FDF65E8FA9670E666DF28A4E21340B510CBE52566F97C4FB94B2BD1
- SPKI SHA-256: AC76F63A46E761B5ACC3259705C920CB7F0563D248D8D180F934AF68099A15F9
- Validity: 2023-05-09 to 2038-05-09
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www1.d-trust.net/pdf-download/D-TRUST_CP_v6.0.pdf; https://www.d-trust.net/pdf-download/D-TRUST_CP_v5.8.pdf, https://www1.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.3.pdf; https://www.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_Standard_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_TLS-BR_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_TLS-EV_Audit_V1.2.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            73:3b:30:04:48:5b:d9:4d:78:2e:73:4b:c9:a1:dc:66
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST BR Root CA 2 2023
        Validity
            Not Before: May  9 08:56:31 2023 GMT
            Not After : May  9 08:56:30 2038 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST BR Root CA 2 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                67:90:F0:D6:DE:B5:18:D5:46:29:7E:5C:AB:F8:9E:08:BC:64:95:10
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 0552E6F83FDF65E8FA9670E666DF28A4E21340B510CBE52566F97C4FB94B2BD1
    SPKI SHA256: AC76F63A46E761B5ACC3259705C920CB7F0563D248D8D180F934AF68099A15F9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp

### D-TRUST EV Root CA 1 2020

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 1 2020
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 1 2020
- Serial: 5F0241D77A877C4C03A3AC968DFBFFD0
- SHA-256: 08170D1AA36453901A2F959245E347DB0C8D37ABAABC56B81AA100DC958970DB
- SPKI SHA-256: 9D37E4A989EAB3882D116052FC8B58446702CB593726E4604C3795940C7103E2
- Validity: 2020-02-11 to 2035-02-11
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www1.d-trust.net/pdf-download/D-TRUST_CP_v6.0.pdf; https://www.d-trust.net/pdf-download/D-TRUST_CP_v5.8.pdf, https://www1.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.3.pdf; https://www.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_Standard_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_TLS-BR_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_TLS-EV_Audit_V1.2.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl, ldap://directory.d-trust.net/CN=D-TRUST%20EV%20Root%20CA%201%202020
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5f:02:41:d7:7a:87:7c:4c:03:a3:ac:96:8d:fb:ff:d0
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST EV Root CA 1 2020
        Validity
            Not Before: Feb 11 10:00:00 2020 GMT
            Not After : Feb 11 09:59:59 2035 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST EV Root CA 1 2020
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                7F:10:01:16:37:3A:A4:28:E4:50:F8:A4:F7:EC:6B:32:B6:FE:E9:8B
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20EV%20Root%20CA%201%202020,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 08170D1AA36453901A2F959245E347DB0C8D37ABAABC56B81AA100DC958970DB
    SPKI SHA256: 9D37E4A989EAB3882D116052FC8B58446702CB593726E4604C3795940C7103E2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl, ldap://directory.d-trust.net/CN=D-TRUST%20EV%20Root%20CA%201%202020
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp

### D-TRUST EV Root CA 2 2023

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 2 2023
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 2 2023
- Serial: 6926097E804B4CA0A78C7862535F5A6F
- SHA-256: 8E8221B2E7D4007836A1672F0DCC299C33BC07D316F132FA1A206D587150F1CE
- SPKI SHA-256: E753CDD9F13413C7CA9CDA82962F8C0CE5ED13D1657312954AF5267EB2CB7C79
- Validity: 2023-05-09 to 2038-05-09
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www1.d-trust.net/pdf-download/D-TRUST_CP_v6.0.pdf; https://www.d-trust.net/pdf-download/D-TRUST_CP_v5.8.pdf, https://www1.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.3.pdf; https://www.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_Standard_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_TLS-BR_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_TLS-EV_Audit_V1.2.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            69:26:09:7e:80:4b:4c:a0:a7:8c:78:62:53:5f:5a:6f
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST EV Root CA 2 2023
        Validity
            Not Before: May  9 09:10:33 2023 GMT
            Not After : May  9 09:10:32 2038 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST EV Root CA 2 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                AA:FC:91:10:1B:87:91:5F:16:B9:BF:4F:4B:91:5E:00:1C:B1:32:80
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 8E8221B2E7D4007836A1672F0DCC299C33BC07D316F132FA1A206D587150F1CE
    SPKI SHA256: E753CDD9F13413C7CA9CDA82962F8C0CE5ED13D1657312954AF5267EB2CB7C79
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp

### D-TRUST Qualified Root CA 1 2007:PN

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Qualified Root CA 1 2007:PN
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Qualified Root CA 1 2007:PN
- Serial: 0326DA
- SHA-256: E8C6AA6B5F58A8F2A6365CF98E65693563A38B7B2F32CF1BE06F2D2229D4BF59
- SPKI SHA-256: A74B4B6A2EB55B9864C04ECB16003FF5DB5B51E42CF859F95E9D0A1DD4644096
- Validity: 2007-06-08 to 2012-06-08
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Removed","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.31.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://qual.ocsp.d-trust.net
- CRL DP: ldap://directory.d-trust.net/CN=D-TRUST%20Qualified%20Root%20CA%201%202007%3APN, http://www.d-trust.net/crl/d-trust_qualified_root_ca_1_2007_pn.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 206554 (0x326da)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Qualified Root CA 1 2007:PN
        Validity
            Not Before: Jun  8 11:47:46 2007 GMT
            Not After : Jun  8 11:47:46 2012 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST Qualified Root CA 1 2007:PN
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 3922478377 (0xe9cc4529)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                2C:4C:F6:9A:2A:9F:28:82:01:C1:99:06:11:AF:B3:4B:7C:B7:9A:FE
            Authority Information Access:
                OCSP - URI:http://qual.ocsp.d-trust.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.31.1
            X509v3 Subject Alternative Name:
                email:info@d-trust.net, URI:http://www.d-trust.net
            qcStatements:
                0
0......F..
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20Qualified%20Root%20CA%201%202007%3APN,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
                  URI:http://www.d-trust.net/crl/d-trust_qualified_root_ca_1_2007_pn.crl
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E8C6AA6B5F58A8F2A6365CF98E65693563A38B7B2F32CF1BE06F2D2229D4BF59
    SPKI SHA256: A74B4B6A2EB55B9864C04ECB16003FF5DB5B51E42CF859F95E9D0A1DD4644096
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.31.1
- AIA OCSP: http://qual.ocsp.d-trust.net
- AIA CA Issuers: -
- CRL Distribution Points: ldap://directory.d-trust.net/CN=D-TRUST%20Qualified%20Root%20CA%201%202007%3APN, http://www.d-trust.net/crl/d-trust_qualified_root_ca_1_2007_pn.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### D-TRUST Root CA 3 2013

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root CA 3 2013
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root CA 3 2013
- Serial: 0FDDAC
- SHA-256: A1A86D04121EB87F027C66F53303C28E5739F943FC84B38AD6AF009035DD9457
- SPKI SHA-256: D49C6F289CD056519492480F192F00A6FC7C1862DAB2E7B5D8E05F6678FAE141
- Validity: 2013-09-20 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www1.d-trust.net/pdf-download/D-TRUST_CP_v6.0.pdf; https://www.d-trust.net/pdf-download/D-TRUST_CP_v5.8.pdf, https://www1.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.3.pdf; https://www1.d-trust.net/pdf-download/EON_SE_PKI_CPS_v3.6.pdf; https://www1.d-trust.net/pdf-download/D-TRUST_Cloud_PKI_CPS_v4.3.pdf; https://www.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_Standard_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_SMIME-BR_Audit_V1.1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20CA%203%202013, http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1039788 (0xfddac)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root CA 3 2013
        Validity
            Not Before: Sep 20 08:25:51 2013 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST Root CA 3 2013
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                3F:90:C8:7D:C7:15:6F:F3:24:8F:A9:C3:2F:4B:A2:0F:21:B2:2F:E7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20Root%20CA%203%202013,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A1A86D04121EB87F027C66F53303C28E5739F943FC84B38AD6AF009035DD9457
    SPKI SHA256: D49C6F289CD056519492480F192F00A6FC7C1862DAB2E7B5D8E05F6678FAE141
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20CA%203%202013, http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp

### D-TRUST Root Class 2 CA 2007

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 2 CA 2007
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 2 CA 2007
- Serial: 030E95
- SHA-256: 8DA75F1327217C88060FD2529EFF2816E50B0C74541EA4EA3DFCEE66A71EFE09
- SPKI SHA-256: D92405C46D912A563E43287F56CD410A1CDF6367C57C9EA7C5CAE039DCBCCE50
- Validity: 2007-05-16 to 2022-05-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Disabled","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://users.ocsp.d-trust.net
- CRL DP: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%202%20CA%202007, http://www.d-trust.net/crl/d-trust_root_class_2_ca_2007.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 200341 (0x30e95)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 2 CA 2007
        Validity
            Not Before: May 16 05:20:47 2007 GMT
            Not After : May 16 05:20:47 2022 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 2 CA 2007
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                91:30:AB:F6:F3:C6:44:B7:EB:DD:28:BC:0F:14:9F:52:5D:62:7F:02
            Authority Information Access:
                OCSP - URI:http://users.ocsp.d-trust.net
            X509v3 Subject Alternative Name:
                email:info@d-trust.net, URI:http://www.d-trust.net
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%202%20CA%202007,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
                  URI:http://www.d-trust.net/crl/d-trust_root_class_2_ca_2007.crl
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 8DA75F1327217C88060FD2529EFF2816E50B0C74541EA4EA3DFCEE66A71EFE09
    SPKI SHA256: D92405C46D912A563E43287F56CD410A1CDF6367C57C9EA7C5CAE039DCBCCE50
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: http://users.ocsp.d-trust.net
- AIA CA Issuers: -
- CRL Distribution Points: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%202%20CA%202007, http://www.d-trust.net/crl/d-trust_root_class_2_ca_2007.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### D-TRUST Root Class 3 CA 2 2009

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 3 CA 2 2009
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 3 CA 2 2009
- Serial: 0983F3
- SHA-256: 49E7A442ACF0EA6287050054B52564B650E4F49E42E348D6AA38E039E957B1C1
- SPKI SHA-256: ECA0F181402CE7A8652B31B4D036DF247E3A30B7F41A50D91EC4F90B006B43A1
- Validity: 2009-11-05 to 2029-11-05
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www1.d-trust.net/pdf-download/D-TRUST_CP_v6.0.pdf; https://www.d-trust.net/pdf-download/D-TRUST_CP_v5.8.pdf, https://www1.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.3.pdf; https://www.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_Standard_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_TLS-BR_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_TLS-EV_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_SMIME-BR_Audit_V1.1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%202009, http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 623603 (0x983f3)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 3 CA 2 2009
        Validity
            Not Before: Nov  5 08:35:58 2009 GMT
            Not After : Nov  5 08:35:58 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 3 CA 2 2009
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                FD:DA:14:C4:9F:30:DE:21:BD:1E:42:39:FC:AB:63:23:49:E0:F1:84
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%202009,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
                Full Name:
                  URI:http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 49E7A442ACF0EA6287050054B52564B650E4F49E42E348D6AA38E039E957B1C1
    SPKI SHA256: ECA0F181402CE7A8652B31B4D036DF247E3A30B7F41A50D91EC4F90B006B43A1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%202009, http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp

### D-TRUST Root Class 3 CA 2 EV 2009

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 3 CA 2 EV 2009
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 3 CA 2 EV 2009
- Serial: 0983F4
- SHA-256: EEC5496B988CE98625B934092EEC2908BED0B0F316C2D4730C84EAF1F3D34881
- SPKI SHA-256: FF342FB6C4C8BD30A4706F73489539F19E6E48CC05F46254654F6610DBC540E9
- Validity: 2009-11-05 to 2029-11-05
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www1.d-trust.net/pdf-download/D-TRUST_CP_v6.0.pdf; https://www.d-trust.net/pdf-download/D-TRUST_CP_v5.8.pdf, https://www1.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.3.pdf; https://www.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_Standard_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_TLS-BR_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_TLS-EV_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_SMIME-BR_Audit_V1.1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%20EV%202009, http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 623604 (0x983f4)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 3 CA 2 EV 2009
        Validity
            Not Before: Nov  5 08:50:46 2009 GMT
            Not After : Nov  5 08:50:46 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 3 CA 2 EV 2009
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                D3:94:8A:4C:62:13:2A:19:2E:CC:AF:72:8A:7D:36:D7:9A:1C:DC:67
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%20EV%202009,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
                Full Name:
                  URI:http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EEC5496B988CE98625B934092EEC2908BED0B0F316C2D4730C84EAF1F3D34881
    SPKI SHA256: FF342FB6C4C8BD30A4706F73489539F19E6E48CC05F46254654F6610DBC540E9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%20EV%202009, http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp

### D-TRUST Root Class 3 CA 2007

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 3 CA 2007
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 3 CA 2007
- Serial: 030E96
- SHA-256: 90F3E05396995FF20922C44592DB62D7845E1BF64AEF512CCA75BC669CAA2479
- SPKI SHA-256: 86C84B1C3A66F4285AF797052467E3ED236FD2986F033C02C4771BE0B970482A
- Validity: 2007-05-16 to 2022-05-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Disabled","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://users.ocsp.d-trust.net
- CRL DP: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202007, http://www.d-trust.net/crl/d-trust_root_class_3_ca_2007.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 200342 (0x30e96)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 3 CA 2007
        Validity
            Not Before: May 16 05:20:47 2007 GMT
            Not After : May 16 05:20:47 2022 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 3 CA 2007
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                82:2F:36:23:49:78:20:42:D7:B0:52:58:A0:D6:74:54:15:78:BF:AA
            Authority Information Access:
                OCSP - URI:http://users.ocsp.d-trust.net
            X509v3 Subject Alternative Name:
                email:info@d-trust.net, URI:http://www.d-trust.net
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202007,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
                  URI:http://www.d-trust.net/crl/d-trust_root_class_3_ca_2007.crl
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 90F3E05396995FF20922C44592DB62D7845E1BF64AEF512CCA75BC669CAA2479
    SPKI SHA256: 86C84B1C3A66F4285AF797052467E3ED236FD2986F033C02C4771BE0B970482A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: http://users.ocsp.d-trust.net
- AIA CA Issuers: -
- CRL Distribution Points: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202007, http://www.d-trust.net/crl/d-trust_root_class_3_ca_2007.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### D-Trust SBR Root CA 1 2022

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 1 2022
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 1 2022
- Serial: 52CFE48C6DA04AF73F82970C80098C95
- SHA-256: D92C171F5CF890BA428019292927FE22F3207FD2B54449CB6F675AF4922146E2
- SPKI SHA-256: 62810B8068F56B10F1F090B6E55DE3C1A6FA72588DB1903F39CBCF777DA2190C
- Validity: 2022-07-06 to 2037-07-06
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www1.d-trust.net/pdf-download/D-TRUST_CP_v6.0.pdf; https://www.d-trust.net/pdf-download/D-TRUST_CP_v5.8.pdf, https://www1.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.3.pdf; https://www.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_Standard_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_SMIME-BR_Audit_V1.1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_1_2022.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_1_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:cf:e4:8c:6d:a0:4a:f7:3f:82:97:0c:80:09:8c:95
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = D-Trust GmbH, CN = D-Trust SBR Root CA 1 2022
        Validity
            Not Before: Jul  6 11:30:00 2022 GMT
            Not After : Jul  6 11:29:59 2037 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-Trust SBR Root CA 1 2022
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                F1:29:A3:1E:01:12:1D:3D:75:56:4D:C7:50:7C:C5:19:AA:0F:18:B7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_sbr_root_ca_1_2022.crl
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: D92C171F5CF890BA428019292927FE22F3207FD2B54449CB6F675AF4922146E2
    SPKI SHA256: 62810B8068F56B10F1F090B6E55DE3C1A6FA72588DB1903F39CBCF777DA2190C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_1_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp

### D-Trust SBR Root CA 2 2022

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 2 2022
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 2 2022
- Serial: 54D5A3951E3D95BA721B9AD031214ABA
- SHA-256: DBA84DD7EF622D485463A90137EA4D574DF8550928F6AFA03B4D8B1141E636CC
- SPKI SHA-256: 6BA0F38065BE15F476C8107AD7E3EAD82813869C57CC264628406EBE050A5EAF
- Validity: 2022-07-07 to 2037-07-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www1.d-trust.net/pdf-download/D-TRUST_CP_v6.0.pdf; https://www.d-trust.net/pdf-download/D-TRUST_CP_v5.8.pdf, https://www1.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.3.pdf; https://www1.d-trust.net/pdf-download/EON_SE_PKI_CPS_v3.6.pdf; https://www.d-trust.net/pdf-download/D-TRUST_CSM_PKI_CPS_v5.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_Standard_Audit_V1.2.pdf, https://www.tuev-nord.de/fileadmin/Sites/TUEV_NORD/Zertifikate/Certification/IT-Zertifikate/de/AA2025121001_D-Trust-CAs_SMIME-BR_Audit_V1.1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            54:d5:a3:95:1e:3d:95:ba:72:1b:9a:d0:31:21:4a:ba
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-Trust SBR Root CA 2 2022
        Validity
            Not Before: Jul  7 07:30:00 2022 GMT
            Not After : Jul  7 07:29:59 2037 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-Trust SBR Root CA 2 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                5D:B3:80:94:1B:E5:86:BF:68:BA:14:34:A4:F6:EE:6D:F2:DD:DF:E7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: DBA84DD7EF622D485463A90137EA4D574DF8550928F6AFA03B4D8B1141E636CC
    SPKI SHA256: 6BA0F38065BE15F476C8107AD7E3EAD82813869C57CC264628406EBE050A5EAF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp

### D-TRUST Application Certificates CA 3-1 2013

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Application Certificates CA 3-1 2013
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root CA 3 2013
- Serial: 0FE0F6
- SHA-256: CB0F7B7670EA2B818ABE80587902434B30EF7A8C0273B84884243F89593EA630
- SPKI SHA-256: A8E3B4F8568C671027D54EF341702CB2BDAA74A69046A39A307C8C463D9BBDCB
- Validity: 2013-09-27 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.d-trust.net/internet/files/D-TRUST_CP.pdf, https://www.d-trust.net/internet/files/D-TRUST_CSM_PKI_CPS.pdf; https://www.d-trust.net/internet/files/D-TRUST_Root_PKI_CPS.pdf; https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_application_certificates_ca_3-1_2013.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_application_certificates_ca_3-1_2013.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.200.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://root-ca-3-2013.ocsp.d-trust.net
- CRL DP: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20CA%203%202013, http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1040630 (0xfe0f6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root CA 3 2013
        Validity
            Not Before: Sep 27 07:30:40 2013 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST Application Certificates CA 3-1 2013
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                3F:90:C8:7D:C7:15:6F:F3:24:8F:A9:C3:2F:4B:A2:0F:21:B2:2F:E7
            Authority Information Access:
                OCSP - URI:http://root-ca-3-2013.ocsp.d-trust.net
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.200.1
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_Root_PKI_CPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20Root%20CA%203%202013,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
            X509v3 Subject Key Identifier:
                19:03:AA:D9:22:45:C7:1A:62:A9:E7:5C:99:B0:9D:DE:ED:D4:B8:B5
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CB0F7B7670EA2B818ABE80587902434B30EF7A8C0273B84884243F89593EA630
    SPKI SHA256: A8E3B4F8568C671027D54EF341702CB2BDAA74A69046A39A307C8C463D9BBDCB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.200.1
- AIA OCSP: http://root-ca-3-2013.ocsp.d-trust.net
- AIA CA Issuers: -
- CRL Distribution Points: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20CA%203%202013, http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### D-TRUST Application Certificates CA 3-1 2013

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Application Certificates CA 3-1 2013
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root CA 3 2013
- Serial: 75BA23247111C35D76C8A163816BC231
- SHA-256: 3F25BD4C92D59A994931ABA53D81507C9EE6B90640BE275C4FF431D1DAB72396
- SPKI SHA-256: A8E3B4F8568C671027D54EF341702CB2BDAA74A69046A39A307C8C463D9BBDCB
- Validity: 2024-07-11 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.d-trust.net/internet/files/D-TRUST_CP.pdf, https://www.d-trust.net/internet/files/D-TRUST_CSM_PKI_CPS.pdf; https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_application_certificates_ca_3-1_2013.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_application_certificates_ca_3-1_2013.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.4.1, 2.23.140.1.5.4.2, 2.23.140.1.5.4.3, 1.3.6.1.4.1.4788.2.200.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://d-trust-root-ca-3-2013.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:ba:23:24:71:11:c3:5d:76:c8:a1:63:81:6b:c2:31
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root CA 3 2013
        Validity
            Not Before: Jul 11 09:38:45 2024 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST Application Certificates CA 3-1 2013
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Authority Key Identifier:
                3F:90:C8:7D:C7:15:6F:F3:24:8F:A9:C3:2F:4B:A2:0F:21:B2:2F:E7
            Authority Information Access:
                OCSP - URI:http://d-trust-root-ca-3-2013.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_Root_CA_3_2013.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.4.1
                Policy: 2.23.140.1.5.4.2
                Policy: 2.23.140.1.5.4.3
                Policy: 1.3.6.1.4.1.4788.2.200.1
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
            X509v3 Subject Key Identifier:
                19:03:AA:D9:22:45:C7:1A:62:A9:E7:5C:99:B0:9D:DE:ED:D4:B8:B5
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3F25BD4C92D59A994931ABA53D81507C9EE6B90640BE275C4FF431D1DAB72396
    SPKI SHA256: A8E3B4F8568C671027D54EF341702CB2BDAA74A69046A39A307C8C463D9BBDCB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.4.1, 2.23.140.1.5.4.2, 2.23.140.1.5.4.3, 1.3.6.1.4.1.4788.2.200.1
- AIA OCSP: http://d-trust-root-ca-3-2013.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_Root_CA_3_2013.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST Application Certificates CA 3-1 2013

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Application Certificates CA 3-1 2013
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root CA 3 2013
- Serial: 7C08DE0B7E23B0E3D74203500F866278
- SHA-256: 9441FD6CD383418465ED911E102A40D2AE82F7443940AAA1C7B49918FFE6028E
- SPKI SHA-256: A8E3B4F8568C671027D54EF341702CB2BDAA74A69046A39A307C8C463D9BBDCB
- Validity: 2024-05-15 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.d-trust.net/internet/files/D-TRUST_CP.pdf, https://www.d-trust.net/internet/files/D-TRUST_CSM_PKI_CPS.pdf; https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_application_certificates_ca_3-1_2013.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_application_certificates_ca_3-1_2013.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.4.1, 2.23.140.1.5.4.2, 2.23.140.1.5.4.3, 1.3.6.1.4.1.4788.2.200.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://d-trust-root-ca-3-2013.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:08:de:0b:7e:23:b0:e3:d7:42:03:50:0f:86:62:78
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root CA 3 2013
        Validity
            Not Before: May 15 09:05:13 2024 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST Application Certificates CA 3-1 2013
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Authority Key Identifier:
                3F:90:C8:7D:C7:15:6F:F3:24:8F:A9:C3:2F:4B:A2:0F:21:B2:2F:E7
            Authority Information Access:
                OCSP - URI:http://d-trust-root-ca-3-2013.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_Root_CA_3_2013.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.4.1
                Policy: 2.23.140.1.5.4.2
                Policy: 2.23.140.1.5.4.3
                Policy: 1.3.6.1.4.1.4788.2.200.1
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
            X509v3 Subject Key Identifier:
                19:03:AA:D9:22:45:C7:1A:62:A9:E7:5C:99:B0:9D:DE:ED:D4:B8:B5
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9441FD6CD383418465ED911E102A40D2AE82F7443940AAA1C7B49918FFE6028E
    SPKI SHA256: A8E3B4F8568C671027D54EF341702CB2BDAA74A69046A39A307C8C463D9BBDCB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.4.1, 2.23.140.1.5.4.2, 2.23.140.1.5.4.3, 1.3.6.1.4.1.4788.2.200.1
- AIA OCSP: http://d-trust-root-ca-3-2013.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_Root_CA_3_2013.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST Application Certificates CA 3-2 2016

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Application Certificates CA 3-2 2016, organizationIdentifier=NTRDE-HRB74346
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root CA 3 2013
- Serial: 0FE48C
- SHA-256: 7890EED59E95743C62826398129BC2F54AD414794AAC075BA67177332802B029
- SPKI SHA-256: 853C6C4CB973A2A421F92F77BB0996634964FB46FAD42C136EA3F3EA6446F18C
- Validity: 2016-11-16 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.d-trust.net/internet/files/D-TRUST_CP.pdf, http://www.d-trust.net/internet/files/D-TRUST_Cloud_PKI_CPS.pdf; https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_application_certificates_ca_3-2_2016.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_application_certificates_ca_3-2_2016.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://root-ca-3-2013.ocsp.d-trust.net
- CRL DP: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20CA%203%202013, http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1041548 (0xfe48c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root CA 3 2013
        Validity
            Not Before: Nov 16 08:54:26 2016 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST Application Certificates CA 3-2 2016, organizationIdentifier = NTRDE-HRB74346
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                3F:90:C8:7D:C7:15:6F:F3:24:8F:A9:C3:2F:4B:A2:0F:21:B2:2F:E7
            Authority Information Access:
                OCSP - URI:http://root-ca-3-2013.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_Root_CA_3_2013.crt
                CA Issuers - URI:ldap://directory.d-trust.net/CN=D-TRUST%20Root%20CA%203%202013,O=D-Trust%20GmbH,C=DE?cACertificate?base?
            X509v3 Certificate Policies:
                Policy: 0.4.0.2042.1.3
                Policy: 1.3.6.1.4.1.4788.2.200.2
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_Cloud_PKI_CPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20Root%20CA%203%202013,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
            X509v3 Subject Key Identifier:
                6A:17:C9:D1:E1:B0:C7:EC:0D:4F:5E:9A:10:86:29:33:E9:85:D1:47
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7890EED59E95743C62826398129BC2F54AD414794AAC075BA67177332802B029
    SPKI SHA256: 853C6C4CB973A2A421F92F77BB0996634964FB46FAD42C136EA3F3EA6446F18C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2
- AIA OCSP: http://root-ca-3-2013.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_Root_CA_3_2013.crt, ldap://directory.d-trust.net/CN=D-TRUST%20Root%20CA%203%202013
- CRL Distribution Points: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20CA%203%202013, http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST BR CA 1-20-1 2020

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR CA 1-20-1 2020
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR Root CA 1 2020
- Serial: 53DDE276119F1CFB5E2D12C6E13BA8B1
- SHA-256: 199AB2AAAFFF40401E0A3B7B87EE9964659EFFA94A1FECBE918AE136E4B4E0A8
- SPKI SHA-256: 9153B929C5612E7F843BB2A30224612E0C6103538ECDD5203833DB0847D9FA44
- Validity: 2020-11-24 to 2035-02-11
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_br_ca_1-20-1_2020.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_br_ca_1-20-1_2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4788.2.202.2, 0.4.0.2042.1.7, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://br-root-ca1-2020.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl, ldap://directory.d-trust.net/CN=D-TRUST%20BR%20Root%20CA%201%202020
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            53:dd:e2:76:11:9f:1c:fb:5e:2d:12:c6:e1:3b:a8:b1
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST BR Root CA 1 2020
        Validity
            Not Before: Nov 24 10:02:24 2020 GMT
            Not After : Feb 11 09:44:59 2035 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST BR CA 1-20-1 2020
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Authority Key Identifier:
                73:91:10:AB:FF:55:B3:5A:7C:09:25:D5:B2:BA:08:A0:6B:AB:1F:6D
            Authority Information Access:
                OCSP - URI:http://br-root-ca1-2020.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_BR_Root_CA_1_2020.crt
                CA Issuers - URI:ldap://directory.d-trust.net/CN=D-TRUST%20BR%20Root%20CA%201%202020,O=D-Trust%20GmbH,C=DE?cACertificate?base?
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.202.2
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
                Policy: 0.4.0.2042.1.7
                Policy: 2.23.140.1.2.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20BR%20Root%20CA%201%202020,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
            X509v3 Subject Key Identifier:
                FE:9B:85:E5:F8:3C:49:C4:6E:F5:9A:27:44:8A:45:65:BD:F5:1F:8A
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 199AB2AAAFFF40401E0A3B7B87EE9964659EFFA94A1FECBE918AE136E4B4E0A8
    SPKI SHA256: 9153B929C5612E7F843BB2A30224612E0C6103538ECDD5203833DB0847D9FA44
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4788.2.202.2, 0.4.0.2042.1.7, 2.23.140.1.2.2
- AIA OCSP: http://br-root-ca1-2020.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_BR_Root_CA_1_2020.crt, ldap://directory.d-trust.net/CN=D-TRUST%20BR%20Root%20CA%201%202020
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl, ldap://directory.d-trust.net/CN=D-TRUST%20BR%20Root%20CA%201%202020
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST BR CA 1-20-2 2020

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR CA 1-20-2 2020
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR Root CA 1 2020
- Serial: 584B92F808A3AE18C0B7A61007E4AD2C
- SHA-256: B268D16934AB5BA232F179CD9F5C7FC07EA8583A56A9A7C1D6CB58FE0823BF5A
- SPKI SHA-256: 9983212D1993421563DAB9F96EDD5651435EB18A85B4DFAB37ACEF284BBC6A46
- Validity: 2020-11-24 to 2035-02-11
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.d-trust.net/internet/files/D-TRUST_CP.pdf, http://www.d-trust.net/internet/files/D-TRUST_CSM_PKI_CPS.pdf; https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_br_ca_1-20-2_2020.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_br_ca_1-20-2_2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4788.2.202.3, 0.4.0.2042.1.6, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://br-root-ca1-2020.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl, ldap://directory.d-trust.net/CN=D-TRUST%20BR%20Root%20CA%201%202020
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            58:4b:92:f8:08:a3:ae:18:c0:b7:a6:10:07:e4:ad:2c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST BR Root CA 1 2020
        Validity
            Not Before: Nov 24 10:13:26 2020 GMT
            Not After : Feb 11 09:44:59 2035 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST BR CA 1-20-2 2020
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Authority Key Identifier:
                73:91:10:AB:FF:55:B3:5A:7C:09:25:D5:B2:BA:08:A0:6B:AB:1F:6D
            Authority Information Access:
                OCSP - URI:http://br-root-ca1-2020.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_BR_Root_CA_1_2020.crt
                CA Issuers - URI:ldap://directory.d-trust.net/CN=D-TRUST%20BR%20Root%20CA%201%202020,O=D-Trust%20GmbH,C=DE?cACertificate?base?
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.202.3
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
                Policy: 0.4.0.2042.1.6
                Policy: 2.23.140.1.2.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20BR%20Root%20CA%201%202020,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
            X509v3 Subject Key Identifier:
                2A:11:63:2D:53:75:A6:FF:A8:34:0C:12:A5:F0:36:70:0E:B6:42:67
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: B268D16934AB5BA232F179CD9F5C7FC07EA8583A56A9A7C1D6CB58FE0823BF5A
    SPKI SHA256: 9983212D1993421563DAB9F96EDD5651435EB18A85B4DFAB37ACEF284BBC6A46
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4788.2.202.3, 0.4.0.2042.1.6, 2.23.140.1.2.1
- AIA OCSP: http://br-root-ca1-2020.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_BR_Root_CA_1_2020.crt, ldap://directory.d-trust.net/CN=D-TRUST%20BR%20Root%20CA%201%202020
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl, ldap://directory.d-trust.net/CN=D-TRUST%20BR%20Root%20CA%201%202020
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST BR CA 2-23-1 2023

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR CA 2-23-1 2023
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR Root CA 2 2023
- Serial: 51F7D7A7C824EA3D11423B35FE712E6A
- SHA-256: D904A27FD2D271DCFE40A1F471033CE48A4B5E1484753DA66F7166D6EBDC06E6
- SPKI SHA-256: A8217381D62CCB6FD688318979B4886E0273A92C59F1B00F12450A9FE6E01A67
- Validity: 2023-05-11 to 2038-05-09
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_br_ca_2-23-1_2023.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_br_ca_2-23-1_2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://d-trust-br-root-ca-2-2023.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            51:f7:d7:a7:c8:24:ea:3d:11:42:3b:35:fe:71:2e:6a
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST BR Root CA 2 2023
        Validity
            Not Before: May 11 08:54:47 2023 GMT
            Not After : May  9 08:56:30 2038 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST BR CA 2-23-1 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Authority Key Identifier:
                67:90:F0:D6:DE:B5:18:D5:46:29:7E:5C:AB:F8:9E:08:BC:64:95:10
            Authority Information Access:
                OCSP - URI:http://d-trust-br-root-ca-2-2023.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_BR_Root_CA_2_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 0.4.0.2042.1.7
                Policy: 1.3.6.1.4.1.4788.2.202.2
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl
            X509v3 Subject Key Identifier:
                B3:FA:D0:F4:21:96:2C:1D:98:F7:90:95:7D:89:FB:5B:00:7B:05:B9
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: D904A27FD2D271DCFE40A1F471033CE48A4B5E1484753DA66F7166D6EBDC06E6
    SPKI SHA256: A8217381D62CCB6FD688318979B4886E0273A92C59F1B00F12450A9FE6E01A67
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2
- AIA OCSP: http://d-trust-br-root-ca-2-2023.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_BR_Root_CA_2_2023.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST BR CA 2-23-2 2023

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR CA 2-23-2 2023
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR Root CA 2 2023
- Serial: 6CC74D6D86B6ECE05F99926C0890632F
- SHA-256: 6685871384605253C264F8D380A8D1DD50A6CA192788FF2D560CAFE541F807B8
- SPKI SHA-256: A861B28CD1D8FE2C4C91B96D940FA660BB615CC8F77B29AF7DA451FFAA483AD4
- Validity: 2023-05-11 to 2038-05-09
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_br_ca_2-23-2_2023.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_br_ca_2-23-2_2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 0.4.0.2042.1.6, 1.3.6.1.4.1.4788.2.202.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://d-trust-br-root-ca-2-2023.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6c:c7:4d:6d:86:b6:ec:e0:5f:99:92:6c:08:90:63:2f
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST BR Root CA 2 2023
        Validity
            Not Before: May 11 09:08:00 2023 GMT
            Not After : May  9 08:56:30 2038 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST BR CA 2-23-2 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Authority Key Identifier:
                67:90:F0:D6:DE:B5:18:D5:46:29:7E:5C:AB:F8:9E:08:BC:64:95:10
            Authority Information Access:
                OCSP - URI:http://d-trust-br-root-ca-2-2023.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_BR_Root_CA_2_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 0.4.0.2042.1.6
                Policy: 1.3.6.1.4.1.4788.2.202.3
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl
            X509v3 Subject Key Identifier:
                72:D4:E9:F0:52:73:C2:5A:F2:CB:10:29:07:B2:D8:95:D6:46:95:99
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 6685871384605253C264F8D380A8D1DD50A6CA192788FF2D560CAFE541F807B8
    SPKI SHA256: A861B28CD1D8FE2C4C91B96D940FA660BB615CC8F77B29AF7DA451FFAA483AD4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 0.4.0.2042.1.6, 1.3.6.1.4.1.4788.2.202.3
- AIA OCSP: http://d-trust-br-root-ca-2-2023.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_BR_Root_CA_2_2023.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST BR EV CA 1-20-3 2025

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR EV CA 1-20-3 2025
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR Root CA 1 2020
- Serial: 78C27B0DB3FDE925C29E53D779D4F191
- SHA-256: 25DA3256E8C88A7E390D2C91A272F478FC2FE32042EB08C6C031F72B2914CBEA
- SPKI SHA-256: C6A91D1A0F045409A93720E2EDA047C5157E7DCBED3F3C2B257B889D31CFC45E
- Validity: 2025-10-02 to 2035-02-11
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_br_ev_ca_1-20-3_2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.2042.1.4, 1.3.6.1.4.1.4788.2.202.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://d-trust-br-root-ca-1-2020.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_br_root_ca_1_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:c2:7b:0d:b3:fd:e9:25:c2:9e:53:d7:79:d4:f1:91
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST BR Root CA 1 2020
        Validity
            Not Before: Oct  2 11:01:37 2025 GMT
            Not After : Feb 11 09:44:59 2035 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST BR EV CA 1-20-3 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                73:91:10:AB:FF:55:B3:5A:7C:09:25:D5:B2:BA:08:A0:6B:AB:1F:6D
            Authority Information Access:
                OCSP - URI:http://d-trust-br-root-ca-1-2020.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_BR_Root_CA_1_2020.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 0.4.0.2042.1.4
                Policy: 1.3.6.1.4.1.4788.2.202.1
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl
                Full Name:
                  URI:http://cdn.d-trust-cloudcrl.net/crl/d-trust_br_root_ca_1_2020.crl
            X509v3 Subject Key Identifier:
                6A:04:97:BD:AA:1E:5D:CE:7B:C7:61:2D:59:27:FD:14:F7:B1:C3:1B
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 25DA3256E8C88A7E390D2C91A272F478FC2FE32042EB08C6C031F72B2914CBEA
    SPKI SHA256: C6A91D1A0F045409A93720E2EDA047C5157E7DCBED3F3C2B257B889D31CFC45E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.2042.1.4, 1.3.6.1.4.1.4788.2.202.1
- AIA OCSP: http://d-trust-br-root-ca-1-2020.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_BR_Root_CA_1_2020.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_br_root_ca_1_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST BR EV CA 2-23-3 2025

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR EV CA 2-23-3 2025
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR Root CA 2 2023
- Serial: 5FBFEAAC9126C4CEFD72E2533C318706
- SHA-256: CB2D2DB7CF95F0CA945EEB48570B763B2C7EED86532E2391E2E10A95C43F43AB
- SPKI SHA-256: BB0CE93F13916C1E918BC6CBB4BF66BF44F5EEA9B4009437067EBA94FE251902
- Validity: 2025-10-02 to 2038-05-09
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_br_ev_ca_2-23-3_2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.2042.1.4, 1.3.6.1.4.1.4788.2.202.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://d-trust-br-root-ca-2-2023.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_br_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5f:bf:ea:ac:91:26:c4:ce:fd:72:e2:53:3c:31:87:06
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST BR Root CA 2 2023
        Validity
            Not Before: Oct  2 11:14:38 2025 GMT
            Not After : May  9 08:56:30 2038 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST BR EV CA 2-23-3 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                67:90:F0:D6:DE:B5:18:D5:46:29:7E:5C:AB:F8:9E:08:BC:64:95:10
            Authority Information Access:
                OCSP - URI:http://d-trust-br-root-ca-2-2023.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_BR_Root_CA_2_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 0.4.0.2042.1.4
                Policy: 1.3.6.1.4.1.4788.2.202.1
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl
                Full Name:
                  URI:http://cdn.d-trust-cloudcrl.net/crl/d-trust_br_root_ca_2_2023.crl
            X509v3 Subject Key Identifier:
                A7:C2:F5:71:06:09:E6:65:40:35:DB:21:CA:DD:2A:0B:B8:4D:19:AD
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: CB2D2DB7CF95F0CA945EEB48570B763B2C7EED86532E2391E2E10A95C43F43AB
    SPKI SHA256: BB0CE93F13916C1E918BC6CBB4BF66BF44F5EEA9B4009437067EBA94FE251902
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.2042.1.4, 1.3.6.1.4.1.4788.2.202.1
- AIA OCSP: http://d-trust-br-root-ca-2-2023.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_BR_Root_CA_2_2023.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_br_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST BR Root CA 1 2020

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR Root CA 1 2020
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 3 CA 2 2009
- Serial: 6A04BF8C2D7E72A7C0864AA263568E39
- SHA-256: 768B6746A28C48CC35024101E58F9786F56B676A3CE94C52F968EB888DD2372E
- SPKI SHA-256: 603F76F28C9FEBA83EC751EDB66C8D7523EA40FE49FE74427629F50DABBCF55A
- Validity: 2025-07-14 to 2029-11-05
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.1, 0.4.0.2042.1.6, 0.4.0.2042.1.7, 0.4.0.2042.1.4, 0.4.0.194112.1.4, 1.3.6.1.4.1.4788.2.202.3, 1.3.6.1.4.1.4788.2.202.2, 1.3.6.1.4.1.4788.2.202.1, 1.3.6.1.4.1.4788.2.150.4
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://d-trust-root-class-3-ca-2-2009.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_root_class_3_ca_2_2009.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6a:04:bf:8c:2d:7e:72:a7:c0:86:4a:a2:63:56:8e:39
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 3 CA 2 2009
        Validity
            Not Before: Jul 14 08:29:00 2025 GMT
            Not After : Nov  5 08:35:58 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST BR Root CA 1 2020
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                FD:DA:14:C4:9F:30:DE:21:BD:1E:42:39:FC:AB:63:23:49:E0:F1:84
            Authority Information Access:
                OCSP - URI:http://d-trust-root-class-3-ca-2-2009.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_Root_Class_3_CA_2_2009.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.1
                Policy: 0.4.0.2042.1.6
                Policy: 0.4.0.2042.1.7
                Policy: 0.4.0.2042.1.4
                Policy: 0.4.0.194112.1.4
                Policy: 1.3.6.1.4.1.4788.2.202.3
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
                Policy: 1.3.6.1.4.1.4788.2.202.2
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
                Policy: 1.3.6.1.4.1.4788.2.202.1
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
                Policy: 1.3.6.1.4.1.4788.2.150.4
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl
                Full Name:
                  URI:http://cdn.d-trust-cloudcrl.net/crl/d-trust_root_class_3_ca_2_2009.crl
            X509v3 Subject Key Identifier:
                73:91:10:AB:FF:55:B3:5A:7C:09:25:D5:B2:BA:08:A0:6B:AB:1F:6D
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 768B6746A28C48CC35024101E58F9786F56B676A3CE94C52F968EB888DD2372E
    SPKI SHA256: 603F76F28C9FEBA83EC751EDB66C8D7523EA40FE49FE74427629F50DABBCF55A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.1, 0.4.0.2042.1.6, 0.4.0.2042.1.7, 0.4.0.2042.1.4, 0.4.0.194112.1.4, 1.3.6.1.4.1.4788.2.202.3, 1.3.6.1.4.1.4788.2.202.2, 1.3.6.1.4.1.4788.2.202.1, 1.3.6.1.4.1.4788.2.150.4
- AIA OCSP: http://d-trust-root-class-3-ca-2-2009.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_Root_Class_3_CA_2_2009.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_root_class_3_ca_2_2009.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier
- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST BR Root CA 2 2023

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR Root CA 2 2023
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 3 CA 2 2009
- Serial: 4ECA5BE7F13021E35CA39E99FB9E9BFE
- SHA-256: 2D208A4CC0BE4216947D965D3AEFB0E37897D7691DDEB017E53E5C078BCD344C
- SPKI SHA-256: AC76F63A46E761B5ACC3259705C920CB7F0563D248D8D180F934AF68099A15F9
- Validity: 2025-07-14 to 2029-11-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.1, 0.4.0.2042.1.6, 0.4.0.2042.1.7, 0.4.0.2042.1.4, 0.4.0.194112.1.4, 1.3.6.1.4.1.4788.2.202.3, 1.3.6.1.4.1.4788.2.202.2, 1.3.6.1.4.1.4788.2.202.1, 1.3.6.1.4.1.4788.2.150.4
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://d-trust-root-class-3-ca-2-2009.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_root_class_3_ca_2_2009.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4e:ca:5b:e7:f1:30:21:e3:5c:a3:9e:99:fb:9e:9b:fe
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 3 CA 2 2009
        Validity
            Not Before: Jul 14 08:32:31 2025 GMT
            Not After : Nov  5 08:35:58 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST BR Root CA 2 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                FD:DA:14:C4:9F:30:DE:21:BD:1E:42:39:FC:AB:63:23:49:E0:F1:84
            Authority Information Access:
                OCSP - URI:http://d-trust-root-class-3-ca-2-2009.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_Root_Class_3_CA_2_2009.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.1
                Policy: 0.4.0.2042.1.6
                Policy: 0.4.0.2042.1.7
                Policy: 0.4.0.2042.1.4
                Policy: 0.4.0.194112.1.4
                Policy: 1.3.6.1.4.1.4788.2.202.3
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
                Policy: 1.3.6.1.4.1.4788.2.202.2
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
                Policy: 1.3.6.1.4.1.4788.2.202.1
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
                Policy: 1.3.6.1.4.1.4788.2.150.4
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl
                Full Name:
                  URI:http://cdn.d-trust-cloudcrl.net/crl/d-trust_root_class_3_ca_2_2009.crl
            X509v3 Subject Key Identifier:
                67:90:F0:D6:DE:B5:18:D5:46:29:7E:5C:AB:F8:9E:08:BC:64:95:10
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 2D208A4CC0BE4216947D965D3AEFB0E37897D7691DDEB017E53E5C078BCD344C
    SPKI SHA256: AC76F63A46E761B5ACC3259705C920CB7F0563D248D8D180F934AF68099A15F9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.1, 0.4.0.2042.1.6, 0.4.0.2042.1.7, 0.4.0.2042.1.4, 0.4.0.194112.1.4, 1.3.6.1.4.1.4788.2.202.3, 1.3.6.1.4.1.4788.2.202.2, 1.3.6.1.4.1.4788.2.202.1, 1.3.6.1.4.1.4788.2.150.4
- AIA OCSP: http://d-trust-root-class-3-ca-2-2009.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_Root_Class_3_CA_2_2009.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_root_class_3_ca_2_2009.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST CA 2-2 EV 2016

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST CA 2-2 EV 2016, organizationIdentifier=NTRDE-HRB74346
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 3 CA 2 EV 2009
- Serial: 0FE48E
- SHA-256: 2316D05A2E2D347FA141135B98ED09F56E81F1CF5679793D3B39DD6D8E461A48
- SPKI SHA-256: 8BABA3291165436220D3A2FCDD5CCF841F6C06518E6420F09148CD2E31ED489A
- Validity: 2016-11-16 to 2029-11-05
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.d-trust.net/internet/files/D-TRUST_CP.pdf, https://www.d-trust.net/internet/files/D-TRUST_CSM_PKI_CPS.pdf; https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_ca_2-2_ev_2016.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_ca_2-2_ev_2016.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 0.4.0.194112.1.4, 1.3.6.1.4.1.4788.2.150.4, 1.3.6.1.4.1.4788.2.202.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://root-c3-ca2-ev-2009.ocsp.d-trust.net
- CRL DP: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%20EV%202009, http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1041550 (0xfe48e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 3 CA 2 EV 2009
        Validity
            Not Before: Nov 16 09:46:19 2016 GMT
            Not After : Nov  5 08:50:46 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST CA 2-2 EV 2016, organizationIdentifier = NTRDE-HRB74346
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                D3:94:8A:4C:62:13:2A:19:2E:CC:AF:72:8A:7D:36:D7:9A:1C:DC:67
            Authority Information Access:
                OCSP - URI:http://root-c3-ca2-ev-2009.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_Root_Class_3_CA_2_EV_2009.crt
                CA Issuers - URI:ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%20EV%202009,O=D-Trust%20GmbH,C=DE?cACertificate?base?
            X509v3 Certificate Policies:
                Policy: 0.4.0.194112.1.4
                Policy: 1.3.6.1.4.1.4788.2.150.4
                Policy: 1.3.6.1.4.1.4788.2.202.1
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_CSM_PKI_CPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%20EV%202009,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl
            X509v3 Subject Key Identifier:
                21:AF:6A:26:98:71:E9:26:0A:D5:DB:A1:8C:F7:DB:A6:9D:A5:25:5C
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2316D05A2E2D347FA141135B98ED09F56E81F1CF5679793D3B39DD6D8E461A48
    SPKI SHA256: 8BABA3291165436220D3A2FCDD5CCF841F6C06518E6420F09148CD2E31ED489A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 0.4.0.194112.1.4, 1.3.6.1.4.1.4788.2.150.4, 1.3.6.1.4.1.4788.2.202.1
- AIA OCSP: http://root-c3-ca2-ev-2009.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_Root_Class_3_CA_2_EV_2009.crt, ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%20EV%202009
- CRL Distribution Points: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%20EV%202009, http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST EV CA 1-20-1 2020

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV CA 1-20-1 2020
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 1 2020
- Serial: 4B352F3E0D5BCCBECE0D15FB51A3FDB6
- SHA-256: 41C897473B0369FA74B1F4F9D7F89129485C1A305C0719A867DC8714E0870200
- SPKI SHA-256: 489107C1C0EF2E9D06FFE09F91F2F220F2C773AFE4F84E0269EA5CA04045AB9B
- Validity: 2020-11-24 to 2035-02-11
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_ev_ca_1-20-1_2020.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_ev_ca_1-20-1_2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4788.2.202.1, 0.4.0.2042.1.4, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ev-root-ca1-2020.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl, ldap://directory.d-trust.net/CN=D-TRUST%20EV%20Root%20CA%201%202020
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4b:35:2f:3e:0d:5b:cc:be:ce:0d:15:fb:51:a3:fd:b6
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST EV Root CA 1 2020
        Validity
            Not Before: Nov 24 10:21:09 2020 GMT
            Not After : Feb 11 09:59:59 2035 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST EV CA 1-20-1 2020
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Authority Key Identifier:
                7F:10:01:16:37:3A:A4:28:E4:50:F8:A4:F7:EC:6B:32:B6:FE:E9:8B
            Authority Information Access:
                OCSP - URI:http://ev-root-ca1-2020.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_1_2020.crt
                CA Issuers - URI:ldap://directory.d-trust.net/CN=D-TRUST%20EV%20Root%20CA%201%202020,O=D-Trust%20GmbH,C=DE?cACertificate?base?
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.202.1
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
                Policy: 0.4.0.2042.1.4
                Policy: 2.23.140.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20EV%20Root%20CA%201%202020,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
            X509v3 Subject Key Identifier:
                38:5E:44:FA:E0:8D:50:CC:82:A8:53:10:A5:60:15:29:CC:23:47:81
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 41C897473B0369FA74B1F4F9D7F89129485C1A305C0719A867DC8714E0870200
    SPKI SHA256: 489107C1C0EF2E9D06FFE09F91F2F220F2C773AFE4F84E0269EA5CA04045AB9B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4788.2.202.1, 0.4.0.2042.1.4, 2.23.140.1.1
- AIA OCSP: http://ev-root-ca1-2020.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_1_2020.crt, ldap://directory.d-trust.net/CN=D-TRUST%20EV%20Root%20CA%201%202020
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl, ldap://directory.d-trust.net/CN=D-TRUST%20EV%20Root%20CA%201%202020
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST EV CA 1-20-2 2020

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV CA 1-20-2 2020
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 1 2020
- Serial: 68E5ED4A66A178CEBC6ECB2ED4A3195D
- SHA-256: BAE31EDF00DC714051BE729BB048D84C7AE93660959EB8E4406B320C2048B2D5
- SPKI SHA-256: AB22F357DED5148D94730E34928EA3AEB32C1F0A7D57987238688CE907CA61A5
- Validity: 2020-11-24 to 2035-02-11
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4788.2.202.1, 1.3.6.1.4.1.4788.2.150.4, 0.4.0.194112.1.4, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ev-root-ca1-2020.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl, ldap://directory.d-trust.net/CN=D-TRUST%20EV%20Root%20CA%201%202020
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            68:e5:ed:4a:66:a1:78:ce:bc:6e:cb:2e:d4:a3:19:5d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST EV Root CA 1 2020
        Validity
            Not Before: Nov 24 10:29:33 2020 GMT
            Not After : Feb 11 09:59:59 2035 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST EV CA 1-20-2 2020
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Authority Key Identifier:
                7F:10:01:16:37:3A:A4:28:E4:50:F8:A4:F7:EC:6B:32:B6:FE:E9:8B
            Authority Information Access:
                OCSP - URI:http://ev-root-ca1-2020.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_1_2020.crt
                CA Issuers - URI:ldap://directory.d-trust.net/CN=D-TRUST%20EV%20Root%20CA%201%202020,O=D-Trust%20GmbH,C=DE?cACertificate?base?
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.202.1
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
                Policy: 1.3.6.1.4.1.4788.2.150.4
                Policy: 0.4.0.194112.1.4
                Policy: 2.23.140.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20EV%20Root%20CA%201%202020,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
            X509v3 Subject Key Identifier:
                BF:28:11:5B:DA:8A:A4:80:79:A3:FC:A2:76:1D:1F:9B:E5:9D:81:D3
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: BAE31EDF00DC714051BE729BB048D84C7AE93660959EB8E4406B320C2048B2D5
    SPKI SHA256: AB22F357DED5148D94730E34928EA3AEB32C1F0A7D57987238688CE907CA61A5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4788.2.202.1, 1.3.6.1.4.1.4788.2.150.4, 0.4.0.194112.1.4, 2.23.140.1.1
- AIA OCSP: http://ev-root-ca1-2020.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_1_2020.crt, ldap://directory.d-trust.net/CN=D-TRUST%20EV%20Root%20CA%201%202020
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl, ldap://directory.d-trust.net/CN=D-TRUST%20EV%20Root%20CA%201%202020
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST EV CA 2-23-1 2023

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV CA 2-23-1 2023
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 2 2023
- Serial: 78E43B52709C353FBFFE03B92A1F7217
- SHA-256: 378CF8738654C8A8544812B1FF2632348225553DA80225692D0491C4A1EEAFB9
- SPKI SHA-256: F087D882024730E1C5CE772F59F778C903A5BFB7E5AFA699360ED6FFB4921B97
- Validity: 2023-05-11 to 2038-05-09
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_ev_ca_2-23-1_2023.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_ev_ca_2-23-1_2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.2042.1.4, 1.3.6.1.4.1.4788.2.202.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:e4:3b:52:70:9c:35:3f:bf:fe:03:b9:2a:1f:72:17
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST EV Root CA 2 2023
        Validity
            Not Before: May 11 09:19:28 2023 GMT
            Not After : May  9 09:10:32 2038 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST EV CA 2-23-1 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Authority Key Identifier:
                AA:FC:91:10:1B:87:91:5F:16:B9:BF:4F:4B:91:5E:00:1C:B1:32:80
            Authority Information Access:
                OCSP - URI:http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_2_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 0.4.0.2042.1.4
                Policy: 1.3.6.1.4.1.4788.2.202.1
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
            X509v3 Subject Key Identifier:
                C3:A2:6B:73:B0:44:07:65:38:69:67:58:38:A6:47:B7:8F:00:77:7E
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 378CF8738654C8A8544812B1FF2632348225553DA80225692D0491C4A1EEAFB9
    SPKI SHA256: F087D882024730E1C5CE772F59F778C903A5BFB7E5AFA699360ED6FFB4921B97
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.2042.1.4, 1.3.6.1.4.1.4788.2.202.1
- AIA OCSP: http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_2_2023.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST EV CA 2-23-2 2023

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV CA 2-23-2 2023, organizationIdentifier=VATDE-202620438
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 2 2023
- Serial: 52ED26B030918DF0B4874DE446D8F622
- SHA-256: 5FF9F5A1C0ED7401E1C529F6D50C4ABB00B17B593358BD2D61DC0DD887DDD92F
- SPKI SHA-256: 0B1CA088E3EFC7F340F599E1071B52334EDE26C0CF079AEF22EC13AEEB52A8B1
- Validity: 2023-05-11 to 2038-05-09
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_ev_ca_2-23-2_2023.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.194112.1.4, 1.3.6.1.4.1.4788.2.150.4, 1.3.6.1.4.1.4788.2.202.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:ed:26:b0:30:91:8d:f0:b4:87:4d:e4:46:d8:f6:22
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST EV Root CA 2 2023
        Validity
            Not Before: May 11 11:42:12 2023 GMT
            Not After : May  9 09:10:32 2038 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST EV CA 2-23-2 2023, organizationIdentifier = VATDE-202620438
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Authority Key Identifier:
                AA:FC:91:10:1B:87:91:5F:16:B9:BF:4F:4B:91:5E:00:1C:B1:32:80
            Authority Information Access:
                OCSP - URI:http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_2_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 0.4.0.194112.1.4
                Policy: 1.3.6.1.4.1.4788.2.150.4
                Policy: 1.3.6.1.4.1.4788.2.202.1
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
            X509v3 Subject Key Identifier:
                55:3C:B3:94:74:02:F0:2E:49:FB:AD:9A:AF:9E:5B:30:16:DA:12:68
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 5FF9F5A1C0ED7401E1C529F6D50C4ABB00B17B593358BD2D61DC0DD887DDD92F
    SPKI SHA256: 0B1CA088E3EFC7F340F599E1071B52334EDE26C0CF079AEF22EC13AEEB52A8B1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.194112.1.4, 1.3.6.1.4.1.4788.2.150.4, 1.3.6.1.4.1.4788.2.202.1
- AIA OCSP: http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_2_2023.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ev_organization_id_missing: subject:organizationIdentifier field is present in an EV certificate but the CA/Browser Forum Organization Identifier Field Extension is missing

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST EV Root CA 1 2020

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 1 2020
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 3 CA 2 EV 2009
- Serial: 4CD52AA8F173BD15C9A0DDC1578F2D7B
- SHA-256: 2FE915B13575DF6A0A8BEB5018B621207116A91C1DDF7E33B94591FAC3F23626
- SPKI SHA-256: 9D37E4A989EAB3882D116052FC8B58446702CB593726E4604C3795940C7103E2
- Validity: 2026-03-25 to 2029-11-05
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 0.4.0.2042.1.4, 0.4.0.2042.1.6, 0.4.0.2042.1.7, 0.4.0.194112.1.4, 1.3.6.1.4.1.4788.2.202.1, 1.3.6.1.4.1.4788.2.202.2, 1.3.6.1.4.1.4788.2.202.3, 1.3.6.1.4.1.4788.2.150.4
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://d-trust-root-class-3-ca-2-ev-2009.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4c:d5:2a:a8:f1:73:bd:15:c9:a0:dd:c1:57:8f:2d:7b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 3 CA 2 EV 2009
        Validity
            Not Before: Mar 25 13:20:00 2026 GMT
            Not After : Nov  5 08:50:46 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST EV Root CA 1 2020
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                D3:94:8A:4C:62:13:2A:19:2E:CC:AF:72:8A:7D:36:D7:9A:1C:DC:67
            Authority Information Access:
                OCSP - URI:http://d-trust-root-class-3-ca-2-ev-2009.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_Root_Class_3_CA_2_EV_2009.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 0.4.0.2042.1.4
                Policy: 0.4.0.2042.1.6
                Policy: 0.4.0.2042.1.7
                Policy: 0.4.0.194112.1.4
                Policy: 1.3.6.1.4.1.4788.2.202.1
                Policy: 1.3.6.1.4.1.4788.2.202.2
                Policy: 1.3.6.1.4.1.4788.2.202.3
                Policy: 1.3.6.1.4.1.4788.2.150.4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl
            X509v3 Subject Key Identifier:
                7F:10:01:16:37:3A:A4:28:E4:50:F8:A4:F7:EC:6B:32:B6:FE:E9:8B
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 2FE915B13575DF6A0A8BEB5018B621207116A91C1DDF7E33B94591FAC3F23626
    SPKI SHA256: 9D37E4A989EAB3882D116052FC8B58446702CB593726E4604C3795940C7103E2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 0.4.0.2042.1.4, 0.4.0.2042.1.6, 0.4.0.2042.1.7, 0.4.0.194112.1.4, 1.3.6.1.4.1.4788.2.202.1, 1.3.6.1.4.1.4788.2.202.2, 1.3.6.1.4.1.4788.2.202.3, 1.3.6.1.4.1.4788.2.150.4
- AIA OCSP: http://d-trust-root-class-3-ca-2-ev-2009.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_Root_Class_3_CA_2_EV_2009.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier
- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST EV Root CA 2 2023

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 2 2023
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 3 CA 2 EV 2009
- Serial: 7077905EAD98CEE11FF203EE5D64145A
- SHA-256: 263C1848F101C4DC6C1D30FC4744610181B956A4D624C30505FE8B2EBEFEAD0B
- SPKI SHA-256: E753CDD9F13413C7CA9CDA82962F8C0CE5ED13D1657312954AF5267EB2CB7C79
- Validity: 2026-03-25 to 2029-11-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 0.4.0.2042.1.4, 0.4.0.2042.1.6, 0.4.0.2042.1.7, 0.4.0.194112.1.4, 1.3.6.1.4.1.4788.2.202.1, 1.3.6.1.4.1.4788.2.202.2, 1.3.6.1.4.1.4788.2.202.3, 1.3.6.1.4.1.4788.2.150.4
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://d-trust-root-class-3-ca-2-ev-2009.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            70:77:90:5e:ad:98:ce:e1:1f:f2:03:ee:5d:64:14:5a
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 3 CA 2 EV 2009
        Validity
            Not Before: Mar 25 13:30:00 2026 GMT
            Not After : Nov  5 08:50:46 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST EV Root CA 2 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                D3:94:8A:4C:62:13:2A:19:2E:CC:AF:72:8A:7D:36:D7:9A:1C:DC:67
            Authority Information Access:
                OCSP - URI:http://d-trust-root-class-3-ca-2-ev-2009.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_Root_Class_3_CA_2_EV_2009.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 0.4.0.2042.1.4
                Policy: 0.4.0.2042.1.6
                Policy: 0.4.0.2042.1.7
                Policy: 0.4.0.194112.1.4
                Policy: 1.3.6.1.4.1.4788.2.202.1
                Policy: 1.3.6.1.4.1.4788.2.202.2
                Policy: 1.3.6.1.4.1.4788.2.202.3
                Policy: 1.3.6.1.4.1.4788.2.150.4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl
            X509v3 Subject Key Identifier:
                AA:FC:91:10:1B:87:91:5F:16:B9:BF:4F:4B:91:5E:00:1C:B1:32:80
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 263C1848F101C4DC6C1D30FC4744610181B956A4D624C30505FE8B2EBEFEAD0B
    SPKI SHA256: E753CDD9F13413C7CA9CDA82962F8C0CE5ED13D1657312954AF5267EB2CB7C79
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 0.4.0.2042.1.4, 0.4.0.2042.1.6, 0.4.0.2042.1.7, 0.4.0.194112.1.4, 1.3.6.1.4.1.4788.2.202.1, 1.3.6.1.4.1.4788.2.202.2, 1.3.6.1.4.1.4788.2.202.3, 1.3.6.1.4.1.4788.2.150.4
- AIA OCSP: http://d-trust-root-class-3-ca-2-ev-2009.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_Root_Class_3_CA_2_EV_2009.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-Trust SBR CA 1-22-1 2022

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 1-22-1 2022, organizationIdentifier=VATDE-202620438
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 1 2022
- Serial: 756156454CB1160A89DC600298797554
- SHA-256: 31FFA8D3F2439C62F2363FE56F4E245382A6D69D8A828B3539FA3875F8C5235B
- SPKI SHA-256: E8CCD0F90B96B33B82EAFCE74C5C375FD3BF331063FB699B2A14D4D7DBD7DB80
- Validity: 2022-07-06 to 2037-07-06
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_sbr_ca_1-22-1_2022.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_sbr_ca_1-22-1_2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.3, 2.23.140.1.5.3.3, 2.23.140.1.5.4.3, 0.4.0.2042.1.1, 1.3.6.1.4.1.4788.2.200.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://d-trust-sbr-root-ca-1-2022.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_1_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:61:56:45:4c:b1:16:0a:89:dc:60:02:98:79:75:54
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = D-Trust GmbH, CN = D-Trust SBR Root CA 1 2022
        Validity
            Not Before: Jul  6 12:07:40 2022 GMT
            Not After : Jul  6 11:29:59 2037 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-Trust SBR CA 1-22-1 2022, organizationIdentifier = VATDE-202620438
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Authority Key Identifier:
                F1:29:A3:1E:01:12:1D:3D:75:56:4D:C7:50:7C:C5:19:AA:0F:18:B7
            Authority Information Access:
                OCSP - URI:http://d-trust-sbr-root-ca-1-2022.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_1_2022.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.3
                Policy: 2.23.140.1.5.4.3
                Policy: 0.4.0.2042.1.1
                Policy: 1.3.6.1.4.1.4788.2.200.3
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_sbr_root_ca_1_2022.crl
            X509v3 Subject Key Identifier:
                BB:6A:6D:5E:EB:16:F3:EF:30:12:3A:AA:E9:72:61:67:4F:9D:EC:04
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 31FFA8D3F2439C62F2363FE56F4E245382A6D69D8A828B3539FA3875F8C5235B
    SPKI SHA256: E8CCD0F90B96B33B82EAFCE74C5C375FD3BF331063FB699B2A14D4D7DBD7DB80
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.3, 2.23.140.1.5.3.3, 2.23.140.1.5.4.3, 0.4.0.2042.1.1, 1.3.6.1.4.1.4788.2.200.3
- AIA OCSP: http://d-trust-sbr-root-ca-1-2022.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_1_2022.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_1_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-Trust SBR CA 1-22-2 2022

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 1-22-2 2022, organizationIdentifier=VATDE-202620438
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 1 2022
- Serial: 6A1E4FE0CE5502A0C4EB061E89EE9F10
- SHA-256: 200E2C50111A71B07555E921D3BFB7EBDE47F7E41873E06753474362BC017BA2
- SPKI SHA-256: 649EECE026A77A7A6805E7E309B73A9F1499AFC2ACA85DB07B5BE0CFB6E2BD5B
- Validity: 2022-07-06 to 2037-07-06
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_sbr_ca_1-22-2_2022.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_sbr_ca_1-22-2_2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.4.1, 2.23.140.1.5.4.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://d-trust-sbr-root-ca-1-2022.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_1_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6a:1e:4f:e0:ce:55:02:a0:c4:eb:06:1e:89:ee:9f:10
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = D-Trust GmbH, CN = D-Trust SBR Root CA 1 2022
        Validity
            Not Before: Jul  6 12:12:37 2022 GMT
            Not After : Jul  6 11:29:59 2037 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-Trust SBR CA 1-22-2 2022, organizationIdentifier = VATDE-202620438
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Authority Key Identifier:
                F1:29:A3:1E:01:12:1D:3D:75:56:4D:C7:50:7C:C5:19:AA:0F:18:B7
            Authority Information Access:
                OCSP - URI:http://d-trust-sbr-root-ca-1-2022.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_1_2022.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.4.1
                Policy: 2.23.140.1.5.4.2
                Policy: 0.4.0.2042.1.3
                Policy: 1.3.6.1.4.1.4788.2.200.2
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_sbr_root_ca_1_2022.crl
            X509v3 Subject Key Identifier:
                8F:CE:C5:48:E4:85:04:BD:8E:79:87:C6:81:53:1F:93:99:00:1C:E0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 200E2C50111A71B07555E921D3BFB7EBDE47F7E41873E06753474362BC017BA2
    SPKI SHA256: 649EECE026A77A7A6805E7E309B73A9F1499AFC2ACA85DB07B5BE0CFB6E2BD5B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.4.1, 2.23.140.1.5.4.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2
- AIA OCSP: http://d-trust-sbr-root-ca-1-2022.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_1_2022.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_1_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-Trust SBR CA 1-22-3 2023

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 1-22-3 2023, organizationIdentifier=VATDE-202620438
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 1 2022
- Serial: 7EBCE6B323BB448F9CCAB298528CFDBD
- SHA-256: D087C970CED1BBCE2E9A73AA7A601CC6A8C877BF1FF3B6089AEDEAE585F2FABA
- SPKI SHA-256: DBA8173BE553B8CC5B02F027F16493E12138350F61F66D0E935984764BE9BCB1
- Validity: 2023-05-09 to 2037-07-06
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_sbr_ca_1-22-3_2023.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_sbr_ca_1-22-3_2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.1.1, 2.23.140.1.5.1.2, 2.23.140.1.5.1.3, 1.3.6.1.4.1.4788.2.200.5
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://d-trust-sbr-root-ca-1-2022.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_1_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:bc:e6:b3:23:bb:44:8f:9c:ca:b2:98:52:8c:fd:bd
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = D-Trust GmbH, CN = D-Trust SBR Root CA 1 2022
        Validity
            Not Before: May  9 11:17:30 2023 GMT
            Not After : Jul  6 11:29:59 2037 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-Trust SBR CA 1-22-3 2023, organizationIdentifier = VATDE-202620438
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Authority Key Identifier:
                F1:29:A3:1E:01:12:1D:3D:75:56:4D:C7:50:7C:C5:19:AA:0F:18:B7
            Authority Information Access:
                OCSP - URI:http://d-trust-sbr-root-ca-1-2022.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_1_2022.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.1.1
                Policy: 2.23.140.1.5.1.2
                Policy: 2.23.140.1.5.1.3
                Policy: 1.3.6.1.4.1.4788.2.200.5
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_sbr_root_ca_1_2022.crl
            X509v3 Subject Key Identifier:
                AB:1C:58:B3:85:90:93:FB:C5:E9:03:52:01:B0:CE:A8:6B:D6:DD:88
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: D087C970CED1BBCE2E9A73AA7A601CC6A8C877BF1FF3B6089AEDEAE585F2FABA
    SPKI SHA256: DBA8173BE553B8CC5B02F027F16493E12138350F61F66D0E935984764BE9BCB1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.1.1, 2.23.140.1.5.1.2, 2.23.140.1.5.1.3, 1.3.6.1.4.1.4788.2.200.5
- AIA OCSP: http://d-trust-sbr-root-ca-1-2022.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_1_2022.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_1_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-Trust SBR CA 1-22-4 2024

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 1-22-4 2024, organizationIdentifier=VATDE-202620438
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 1 2022
- Serial: 55044BDC189CAA3EA67294D14CBA7C6F
- SHA-256: DD69E93713BAE0F4B529A485BAE1FD25B61DDF6DBC25CDE25D0F365CD14CE4DE
- SPKI SHA-256: 5C8BA5718AAC3B79F9A5DFE31748E7F734B6957243F63D67D521A1D9039AEFB3
- Validity: 2024-05-14 to 2037-07-06
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_sbr_ca_1-22-4_2024.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_sbr_ca_1-22-4_2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.2, 2.23.140.1.5.3.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://d-trust-sbr-root-ca-1-2022.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_1_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            55:04:4b:dc:18:9c:aa:3e:a6:72:94:d1:4c:ba:7c:6f
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = D-Trust GmbH, CN = D-Trust SBR Root CA 1 2022
        Validity
            Not Before: May 14 11:58:38 2024 GMT
            Not After : Jul  6 11:29:59 2037 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-Trust SBR CA 1-22-4 2024, organizationIdentifier = VATDE-202620438
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Authority Key Identifier:
                F1:29:A3:1E:01:12:1D:3D:75:56:4D:C7:50:7C:C5:19:AA:0F:18:B7
            Authority Information Access:
                OCSP - URI:http://d-trust-sbr-root-ca-1-2022.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_1_2022.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.3.2
                Policy: 0.4.0.2042.1.3
                Policy: 1.3.6.1.4.1.4788.2.200.2
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_sbr_root_ca_1_2022.crl
            X509v3 Subject Key Identifier:
                2C:22:91:8C:E2:A3:AC:F2:2C:EF:E6:26:63:2E:62:B7:0B:C3:23:F1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: DD69E93713BAE0F4B529A485BAE1FD25B61DDF6DBC25CDE25D0F365CD14CE4DE
    SPKI SHA256: 5C8BA5718AAC3B79F9A5DFE31748E7F734B6957243F63D67D521A1D9039AEFB3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.2, 2.23.140.1.5.3.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2
- AIA OCSP: http://d-trust-sbr-root-ca-1-2022.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_1_2022.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_1_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-Trust SBR CA 1-22-5 2024

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 1-22-5 2024, organizationIdentifier=VATDE-202620438
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 1 2022
- Serial: 706C9A7A4E805A90FC1038C9924E68F4
- SHA-256: 087C5E12093A48D3064C3352CF7B1017C57492E1BE02A3B032AC42ED079F9845
- SPKI SHA-256: B7B941A5E681595BD8070F5D0BA1EFFAAE8847F5FDAA7F62B66743B77991A6A5
- Validity: 2024-05-14 to 2037-07-06
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_sbr_ca_1-22-5_2024.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_sbr_ca_1-22-5_2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.2, 2.23.140.1.5.3.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://d-trust-sbr-root-ca-1-2022.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_1_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            70:6c:9a:7a:4e:80:5a:90:fc:10:38:c9:92:4e:68:f4
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = D-Trust GmbH, CN = D-Trust SBR Root CA 1 2022
        Validity
            Not Before: May 14 12:02:06 2024 GMT
            Not After : Jul  6 11:29:59 2037 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-Trust SBR CA 1-22-5 2024, organizationIdentifier = VATDE-202620438
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Authority Key Identifier:
                F1:29:A3:1E:01:12:1D:3D:75:56:4D:C7:50:7C:C5:19:AA:0F:18:B7
            Authority Information Access:
                OCSP - URI:http://d-trust-sbr-root-ca-1-2022.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_1_2022.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.3.2
                Policy: 0.4.0.2042.1.3
                Policy: 1.3.6.1.4.1.4788.2.200.2
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_sbr_root_ca_1_2022.crl
            X509v3 Subject Key Identifier:
                A9:7A:E9:FA:B6:9A:4E:04:8E:F6:70:C1:9C:EF:CF:73:35:25:83:AC
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 087C5E12093A48D3064C3352CF7B1017C57492E1BE02A3B032AC42ED079F9845
    SPKI SHA256: B7B941A5E681595BD8070F5D0BA1EFFAAE8847F5FDAA7F62B66743B77991A6A5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.2, 2.23.140.1.5.3.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2
- AIA OCSP: http://d-trust-sbr-root-ca-1-2022.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_1_2022.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_1_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-Trust SBR CA 2-22-1 2022

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 2-22-1 2022, organizationIdentifier=VATDE-202620438
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 2 2022
- Serial: 4BA66639C04100394B4156E9051D8B99
- SHA-256: CED8E0893E52A1C96AE65D9955A908C45003D7CEADE56B3E4717FD8F00EE0743
- SPKI SHA-256: 3D03914D2ED650860BE4FF98F2D0DFB6417E185041888544EEFED652A9DC4DB5
- Validity: 2022-07-07 to 2037-07-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.d-trust.net/internet/files/D-TRUST_CP.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_sbr_ca_2-22-1_2022.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_sbr_ca_2-22-1_2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.3, 2.23.140.1.5.3.3, 2.23.140.1.5.4.3, 0.4.0.2042.1.1, 1.3.6.1.4.1.4788.2.200.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4b:a6:66:39:c0:41:00:39:4b:41:56:e9:05:1d:8b:99
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-Trust SBR Root CA 2 2022
        Validity
            Not Before: Jul  7 07:57:09 2022 GMT
            Not After : Jul  7 07:29:59 2037 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-Trust SBR CA 2-22-1 2022, organizationIdentifier = VATDE-202620438
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Authority Key Identifier:
                5D:B3:80:94:1B:E5:86:BF:68:BA:14:34:A4:F6:EE:6D:F2:DD:DF:E7
            Authority Information Access:
                OCSP - URI:http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_2_2022.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.3
                Policy: 2.23.140.1.5.4.3
                Policy: 0.4.0.2042.1.1
                Policy: 1.3.6.1.4.1.4788.2.200.3
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
            X509v3 Subject Key Identifier:
                22:41:99:AC:19:FF:E0:34:09:C0:22:27:23:08:CA:54:93:5E:B5:78
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: CED8E0893E52A1C96AE65D9955A908C45003D7CEADE56B3E4717FD8F00EE0743
    SPKI SHA256: 3D03914D2ED650860BE4FF98F2D0DFB6417E185041888544EEFED652A9DC4DB5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.3, 2.23.140.1.5.3.3, 2.23.140.1.5.4.3, 0.4.0.2042.1.1, 1.3.6.1.4.1.4788.2.200.3
- AIA OCSP: http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_2_2022.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-Trust SBR CA 2-22-2 2022

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 2-22-2 2022, organizationIdentifier=VATDE-202620438
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 2 2022
- Serial: 480AE585CDB13A27E8039E0A3168EB1E
- SHA-256: 6E87C6E63C8BEE394908B97D1079F8FF88C3930E0EBEC5708C159E2B83247FF0
- SPKI SHA-256: 6155B887C8BD9753617BE566FDC70E2B3051A86BB6E231239FBAD7DF85D8DC66
- Validity: 2022-07-07 to 2037-07-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.d-trust.net/internet/files/D-TRUST_CP.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_sbr_ca_2-22-2_2022.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_sbr_ca_2-22-2_2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.4.1, 2.23.140.1.5.4.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:0a:e5:85:cd:b1:3a:27:e8:03:9e:0a:31:68:eb:1e
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-Trust SBR Root CA 2 2022
        Validity
            Not Before: Jul  7 08:01:50 2022 GMT
            Not After : Jul  7 07:29:59 2037 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-Trust SBR CA 2-22-2 2022, organizationIdentifier = VATDE-202620438
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Authority Key Identifier:
                5D:B3:80:94:1B:E5:86:BF:68:BA:14:34:A4:F6:EE:6D:F2:DD:DF:E7
            Authority Information Access:
                OCSP - URI:http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_2_2022.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.4.1
                Policy: 2.23.140.1.5.4.2
                Policy: 0.4.0.2042.1.3
                Policy: 1.3.6.1.4.1.4788.2.200.2
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
            X509v3 Subject Key Identifier:
                96:F6:AD:77:5F:B5:D6:09:2D:52:63:B8:8C:3D:DA:93:87:31:B3:0E
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 6E87C6E63C8BEE394908B97D1079F8FF88C3930E0EBEC5708C159E2B83247FF0
    SPKI SHA256: 6155B887C8BD9753617BE566FDC70E2B3051A86BB6E231239FBAD7DF85D8DC66
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.4.1, 2.23.140.1.5.4.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2
- AIA OCSP: http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_2_2022.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-Trust SBR CA 2-22-3 2023

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 2-22-3 2023, organizationIdentifier=VATDE-202620438
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 2 2022
- Serial: 7AABD767B389331D61FE52540BC60C08
- SHA-256: ED65312EB2E5F93293CCF370803CD3A66D1670C8D3A4825F5EA428F03F8ACCCC
- SPKI SHA-256: D84ED1A18D396E30F457E0C2F103DADBC171F47B31D2EFDA9AF60C7D17EC04C3
- Validity: 2023-05-09 to 2037-07-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.d-trust.net/internet/files/D-TRUST_CP.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_sbr_ca_2-22-3_2023.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_sbr_ca_2-22-3_2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.1.1, 2.23.140.1.5.1.2, 2.23.140.1.5.1.3, 1.3.6.1.4.1.4788.2.200.5
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:ab:d7:67:b3:89:33:1d:61:fe:52:54:0b:c6:0c:08
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-Trust SBR Root CA 2 2022
        Validity
            Not Before: May  9 11:31:36 2023 GMT
            Not After : Jul  7 07:29:59 2037 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-Trust SBR CA 2-22-3 2023, organizationIdentifier = VATDE-202620438
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Authority Key Identifier:
                5D:B3:80:94:1B:E5:86:BF:68:BA:14:34:A4:F6:EE:6D:F2:DD:DF:E7
            Authority Information Access:
                OCSP - URI:http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_2_2022.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.1.1
                Policy: 2.23.140.1.5.1.2
                Policy: 2.23.140.1.5.1.3
                Policy: 1.3.6.1.4.1.4788.2.200.5
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
            X509v3 Subject Key Identifier:
                B4:C6:F8:6F:BD:14:EC:95:20:18:D9:E7:65:70:8B:63:C9:21:39:D0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: ED65312EB2E5F93293CCF370803CD3A66D1670C8D3A4825F5EA428F03F8ACCCC
    SPKI SHA256: D84ED1A18D396E30F457E0C2F103DADBC171F47B31D2EFDA9AF60C7D17EC04C3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.1.1, 2.23.140.1.5.1.2, 2.23.140.1.5.1.3, 1.3.6.1.4.1.4788.2.200.5
- AIA OCSP: http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_2_2022.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-Trust SBR CA 2-22-4 2024

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 2-22-4 2024, organizationIdentifier=VATDE-202620438
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 2 2022
- Serial: 7BF1B02389D37D30F932A86165B2DF64
- SHA-256: 5A128127FFEF4C2F7443F6695B5C96B572DCD8092131449F1497728F2EE4C59B
- SPKI SHA-256: A1C32E2A6B1DEDDDA4CA970848C3BFC5B50A3DFC1A159D0B998875A1E189CC06
- Validity: 2024-05-14 to 2037-07-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.d-trust.net/internet/files/D-TRUST_CP.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_sbr_ca_2-22-4_2024.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_sbr_ca_2-22-4_2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.2, 2.23.140.1.5.3.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:f1:b0:23:89:d3:7d:30:f9:32:a8:61:65:b2:df:64
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-Trust SBR Root CA 2 2022
        Validity
            Not Before: May 14 12:08:11 2024 GMT
            Not After : Jul  7 07:29:59 2037 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-Trust SBR CA 2-22-4 2024, organizationIdentifier = VATDE-202620438
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Authority Key Identifier:
                5D:B3:80:94:1B:E5:86:BF:68:BA:14:34:A4:F6:EE:6D:F2:DD:DF:E7
            Authority Information Access:
                OCSP - URI:http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_2_2022.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.3.2
                Policy: 0.4.0.2042.1.3
                Policy: 1.3.6.1.4.1.4788.2.200.2
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
            X509v3 Subject Key Identifier:
                93:A9:83:D5:87:E3:11:3F:1D:CD:97:2D:68:FD:A9:7A:02:F5:C4:0A
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 5A128127FFEF4C2F7443F6695B5C96B572DCD8092131449F1497728F2EE4C59B
    SPKI SHA256: A1C32E2A6B1DEDDDA4CA970848C3BFC5B50A3DFC1A159D0B998875A1E189CC06
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.2, 2.23.140.1.5.3.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2
- AIA OCSP: http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_2_2022.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-Trust SBR CA 2-22-5 2024

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR CA 2-22-5 2024, organizationIdentifier=VATDE-202620438
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 2 2022
- Serial: 5394F0E167C8FD028CD91B27D6301EBD
- SHA-256: 1B410BA647ADD270CEBF6F6C6CC4BD69533E868D710325383965EC32C5EF8938
- SPKI SHA-256: A0F6D3353077CD1B2406164BED895FC5FAA87C3D11612775F150D87FE2EF09CD
- Validity: 2024-05-14 to 2037-07-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.d-trust.net/internet/files/D-TRUST_CP.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_sbr_ca_2-22-5_2024.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_sbr_ca_2-22-5_2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.2, 2.23.140.1.5.3.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            53:94:f0:e1:67:c8:fd:02:8c:d9:1b:27:d6:30:1e:bd
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-Trust SBR Root CA 2 2022
        Validity
            Not Before: May 14 12:11:01 2024 GMT
            Not After : Jul  7 07:29:59 2037 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-Trust SBR CA 2-22-5 2024, organizationIdentifier = VATDE-202620438
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Authority Key Identifier:
                5D:B3:80:94:1B:E5:86:BF:68:BA:14:34:A4:F6:EE:6D:F2:DD:DF:E7
            Authority Information Access:
                OCSP - URI:http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_2_2022.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.3.2
                Policy: 0.4.0.2042.1.3
                Policy: 1.3.6.1.4.1.4788.2.200.2
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
            X509v3 Subject Key Identifier:
                53:9C:E5:EF:81:E9:01:A2:18:97:F4:30:79:13:4B:3F:14:FF:13:B4
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 1B410BA647ADD270CEBF6F6C6CC4BD69533E868D710325383965EC32C5EF8938
    SPKI SHA256: A0F6D3353077CD1B2406164BED895FC5FAA87C3D11612775F150D87FE2EF09CD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.2, 2.23.140.1.5.3.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2
- AIA OCSP: http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_2_2022.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-Trust SBR Root CA 2 2022

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 2 2022
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root CA 3 2013
- Serial: 48F4A355E1EDB6B40D512B6A8B772CE6
- SHA-256: 7B2D0CE123F48B27CD6333B1FB113FF9134BF97793902CFFBF3BE326A5D0101D
- SPKI SHA-256: 6BA0F38065BE15F476C8107AD7E3EAD82813869C57CC264628406EBE050A5EAF
- Validity: 2025-07-14 to 2028-09-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.1.2, 2.23.140.1.5.1.3, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 2.23.140.1.5.4.2, 2.23.140.1.5.4.3, 0.4.0.2042.1.1, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2, 1.3.6.1.4.1.4788.2.200.3, 1.3.6.1.4.1.4788.2.200.5
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://d-trust-root-ca-3-2013.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_root_ca_3_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:f4:a3:55:e1:ed:b6:b4:0d:51:2b:6a:8b:77:2c:e6
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root CA 3 2013
        Validity
            Not Before: Jul 14 08:21:00 2025 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-Trust SBR Root CA 2 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Authority Key Identifier:
                3F:90:C8:7D:C7:15:6F:F3:24:8F:A9:C3:2F:4B:A2:0F:21:B2:2F:E7
            Authority Information Access:
                OCSP - URI:http://d-trust-root-ca-3-2013.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_Root_CA_3_2013.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.1.2
                Policy: 2.23.140.1.5.1.3
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 2.23.140.1.5.4.2
                Policy: 2.23.140.1.5.4.3
                Policy: 0.4.0.2042.1.1
                Policy: 0.4.0.2042.1.3
                Policy: 1.3.6.1.4.1.4788.2.200.2
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
                Policy: 1.3.6.1.4.1.4788.2.200.3
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
                Policy: 1.3.6.1.4.1.4788.2.200.5
                  CPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
                Full Name:
                  URI:http://cdn.d-trust-cloudcrl.net/crl/d-trust_root_ca_3_2013.crl
            X509v3 Subject Key Identifier:
                5D:B3:80:94:1B:E5:86:BF:68:BA:14:34:A4:F6:EE:6D:F2:DD:DF:E7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 7B2D0CE123F48B27CD6333B1FB113FF9134BF97793902CFFBF3BE326A5D0101D
    SPKI SHA256: 6BA0F38065BE15F476C8107AD7E3EAD82813869C57CC264628406EBE050A5EAF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.1.2, 2.23.140.1.5.1.3, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 2.23.140.1.5.4.2, 2.23.140.1.5.4.3, 0.4.0.2042.1.1, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.200.2, 1.3.6.1.4.1.4788.2.200.3, 1.3.6.1.4.1.4788.2.200.5
- AIA OCSP: http://d-trust-root-ca-3-2013.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_Root_CA_3_2013.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_root_ca_3_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_mailbox_validated_allowed_subjectdn_attributes: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST SCE384 CA 1-20-31 2026

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST SCE384 CA 1-20-31 2026
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR Root CA 1 2020
- Serial: 61C4E8EE638C8EB182A938F7E8D01CDF
- SHA-256: 6BA41C66AEB28538CAAE6E374ABA28A67224E4AD3FF93DBB4CA23A249D22E681
- SPKI SHA-256: B5272E0B811BB8C588F8A5560ACDD0A44D6A10B248DBFCF136DB87BEBFF7CF26
- Validity: 2026-06-02 to 2035-02-11
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_sce384_ca_1-20-31_2026.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_sce384_ca_1-20-31_2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://d-trust-br-root-ca-1-2020.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:c4:e8:ee:63:8c:8e:b1:82:a9:38:f7:e8:d0:1c:df
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST BR Root CA 1 2020
        Validity
            Not Before: Jun  2 11:23:45 2026 GMT
            Not After : Feb 11 09:44:59 2035 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST SCE384 CA 1-20-31 2026
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Authority Key Identifier:
                73:91:10:AB:FF:55:B3:5A:7C:09:25:D5:B2:BA:08:A0:6B:AB:1F:6D
            Authority Information Access:
                OCSP - URI:http://d-trust-br-root-ca-1-2020.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_BR_Root_CA_1_2020.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 0.4.0.2042.1.7
                Policy: 1.3.6.1.4.1.4788.2.202.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl
            X509v3 Subject Key Identifier:
                10:B2:D6:5B:C9:E0:E3:9B:91:AA:69:A1:C1:6B:C8:23:2A:19:DD:19
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 6BA41C66AEB28538CAAE6E374ABA28A67224E4AD3FF93DBB4CA23A249D22E681
    SPKI SHA256: B5272E0B811BB8C588F8A5560ACDD0A44D6A10B248DBFCF136DB87BEBFF7CF26
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2
- AIA OCSP: http://d-trust-br-root-ca-1-2020.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_BR_Root_CA_1_2020.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST SCR4096 CA 2-23-31 2026

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST SCR4096 CA 2-23-31 2026
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST BR Root CA 2 2023
- Serial: 71495087152BB1DF514C80E9FD8B43C4
- SHA-256: 2FF83C9B6976CC32CD6A01994CC815BD0610519773B2E2C9F83B502DFBDDB12E
- SPKI SHA-256: 73BDDFDF59ED6639814E4E1A1A1731B618FD372AFA8878C578827D86FEED2633
- Validity: 2026-06-02 to 2038-05-09
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_scr4096_ca_2-23-31_2026.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_scr4096_ca_2-23-31_2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://d-trust-br-root-ca-2-2023.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            71:49:50:87:15:2b:b1:df:51:4c:80:e9:fd:8b:43:c4
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST BR Root CA 2 2023
        Validity
            Not Before: Jun  2 11:11:20 2026 GMT
            Not After : May  9 08:56:30 2038 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST SCR4096 CA 2-23-31 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Authority Key Identifier:
                67:90:F0:D6:DE:B5:18:D5:46:29:7E:5C:AB:F8:9E:08:BC:64:95:10
            Authority Information Access:
                OCSP - URI:http://d-trust-br-root-ca-2-2023.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_BR_Root_CA_2_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 0.4.0.2042.1.7
                Policy: 1.3.6.1.4.1.4788.2.202.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl
            X509v3 Subject Key Identifier:
                AC:47:19:F7:28:BD:F0:19:EC:33:A4:78:C7:DD:37:AC:1C:4F:2B:2F
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 2FF83C9B6976CC32CD6A01994CC815BD0610519773B2E2C9F83B502DFBDDB12E
    SPKI SHA256: 73BDDFDF59ED6639814E4E1A1A1731B618FD372AFA8878C578827D86FEED2633
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2
- AIA OCSP: http://d-trust-br-root-ca-2-2023.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_BR_Root_CA_2_2023.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST SSL CA 2 2020

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST SSL CA 2 2020
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 3 CA 2 2009
- Serial: 56467FB7B1B00F5C3FA12B46C885D133
- SHA-256: 972A181B60294EBA07333B9C1982440D43395ABA91D450EC0EFB485AED49D5A7
- SPKI SHA-256: 430EF2067961DF2810C364ACE0F0A67ECABDE097BE60062732E33D0A974C4B4C
- Validity: 2020-04-21 to 2029-11-05
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.d-trust.net/internet/files/D-TRUST_CP.pdf, https://www.d-trust.net/internet/files/D-TRUST_CSM_PKI_CPS.pdf; https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_ssl_ca_2_2020.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_ssl_ca_2_2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 0.4.0.2042.1.6, 1.3.6.1.4.1.4788.2.202.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://root-c3-ca2-2009.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl, ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%202009
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            56:46:7f:b7:b1:b0:0f:5c:3f:a1:2b:46:c8:85:d1:33
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 3 CA 2 2009
        Validity
            Not Before: Apr 21 08:16:14 2020 GMT
            Not After : Nov  5 08:35:58 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST SSL CA 2 2020
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Authority Key Identifier:
                FD:DA:14:C4:9F:30:DE:21:BD:1E:42:39:FC:AB:63:23:49:E0:F1:84
            Authority Information Access:
                OCSP - URI:http://root-c3-ca2-2009.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_Root_Class_3_CA_2_2009.crt
                CA Issuers - URI:ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%202009,O=D-Trust%20GmbH,C=DE?cACertificate?base?
            X509v3 Certificate Policies:
                Policy: 0.4.0.2042.1.6
                Policy: 1.3.6.1.4.1.4788.2.202.3
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_CSM_PKI_CPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%202009,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
            X509v3 Subject Key Identifier:
                B9:13:F2:71:BC:6B:F5:8F:37:93:C2:4C:A5:87:EF:CA:4B:1F:F1:3C
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 972A181B60294EBA07333B9C1982440D43395ABA91D450EC0EFB485AED49D5A7
    SPKI SHA256: 430EF2067961DF2810C364ACE0F0A67ECABDE097BE60062732E33D0A974C4B4C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 0.4.0.2042.1.6, 1.3.6.1.4.1.4788.2.202.3
- AIA OCSP: http://root-c3-ca2-2009.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_Root_Class_3_CA_2_2009.crt, ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%202009
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl, ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%202009
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST SSL Class 3 CA 1 2009

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST SSL Class 3 CA 1 2009
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 3 CA 2 2009
- Serial: 099063
- SHA-256: 6AC159B4C2BC8E729F3B84642EF1286BCC80D775FE278C740ADA468D59439025
- SPKI SHA-256: F70D103FD1F32D791FB3EE3310D69416AD9729C40E375A3292CA09F868360191
- Validity: 2009-11-12 to 2029-11-05
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_ssl_class_3_ca_1_2009.der.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_ssl_class_3_ca_1_2009.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://root-c3-ca2-2009.ocsp.d-trust.net
- CRL DP: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%202009, http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 626787 (0x99063)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 3 CA 2 2009
        Validity
            Not Before: Nov 12 12:46:55 2009 GMT
            Not After : Nov  5 08:35:58 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST SSL Class 3 CA 1 2009
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FD:DA:14:C4:9F:30:DE:21:BD:1E:42:39:FC:AB:63:23:49:E0:F1:84
            Authority Information Access:
                OCSP - URI:http://root-c3-ca2-2009.ocsp.d-trust.net
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_Root_PKI_CPS.pdf
            X509v3 Subject Alternative Name:
                email:info@d-trust.net, URI:http://www.d-trust.net
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%202009,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
                Full Name:
                  URI:http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl
            X509v3 Subject Key Identifier:
                50:19:32:94:9A:C4:B5:04:4D:56:D0:C0:83:21:D5:35:55:B0:B1:7A
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6AC159B4C2BC8E729F3B84642EF1286BCC80D775FE278C740ADA468D59439025
    SPKI SHA256: F70D103FD1F32D791FB3EE3310D69416AD9729C40E375A3292CA09F868360191
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://root-c3-ca2-2009.ocsp.d-trust.net
- AIA CA Issuers: -
- CRL Distribution Points: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%202009, http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### D-TRUST SSL Class 3 CA 1 EV 2009

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST SSL Class 3 CA 1 EV 2009
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 3 CA 2 EV 2009
- Serial: 099064
- SHA-256: B0935DC04B4E60C0C42DEF7EC57A1B1D8F958D17988E71CC80A8CF5E635BA5B4
- SPKI SHA-256: 96FE41359E5A59DDBBA28A2550B0E89454F021A6968C7BC6E32C87DEBB2CE17F
- Validity: 2009-11-12 to 2029-11-05
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_ssl_class_3_ca_1_ev_2009.der.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_ssl_class_3_ca_1_ev_2009.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://root-c3-ca2-ev-2009.ocsp.d-trust.net
- CRL DP: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%20EV%202009, http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 626788 (0x99064)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 3 CA 2 EV 2009
        Validity
            Not Before: Nov 12 12:52:43 2009 GMT
            Not After : Nov  5 08:50:46 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST SSL Class 3 CA 1 EV 2009
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                D3:94:8A:4C:62:13:2A:19:2E:CC:AF:72:8A:7D:36:D7:9A:1C:DC:67
            Authority Information Access:
                OCSP - URI:http://root-c3-ca2-ev-2009.ocsp.d-trust.net
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_Root_PKI_CPS.pdf
            X509v3 Subject Alternative Name:
                email:info@d-trust.net, URI:http://www.d-trust.net
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%20EV%202009,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
                Full Name:
                  URI:http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl
            X509v3 Subject Key Identifier:
                AC:ED:A5:9D:7A:A2:B6:43:F1:18:8A:25:6A:6C:B1:CC:A8:F2:5A:D4
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B0935DC04B4E60C0C42DEF7EC57A1B1D8F958D17988E71CC80A8CF5E635BA5B4
    SPKI SHA256: 96FE41359E5A59DDBBA28A2550B0E89454F021A6968C7BC6E32C87DEBB2CE17F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://root-c3-ca2-ev-2009.ocsp.d-trust.net
- AIA CA Issuers: -
- CRL Distribution Points: ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%20EV%202009, http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### D-TRUST WE384 CA 1-20-12 2026

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST WE384 CA 1-20-12 2026
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 1 2020
- Serial: 7307F4A93544C7A7316B2B585CAA7FE8
- SHA-256: 498F683D2BA40AC20A43E80C5B7D267F443E15EB896B616B3A50B70BFBE4E440
- SPKI SHA-256: A3C1FD49FB595619FD8E6CB4B70CD7E42F25F07E6294298F233FB9C095B2BAF9
- Validity: 2026-07-17 to 2029-07-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://d-trust-ev-root-ca-1-2020.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            73:07:f4:a9:35:44:c7:a7:31:6b:2b:58:5c:aa:7f:e8
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST EV Root CA 1 2020
        Validity
            Not Before: Jul 17 07:56:00 2026 GMT
            Not After : Jul 16 07:55:59 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST WE384 CA 1-20-12 2026
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                7F:10:01:16:37:3A:A4:28:E4:50:F8:A4:F7:EC:6B:32:B6:FE:E9:8B
            Authority Information Access:
                OCSP - URI:http://d-trust-ev-root-ca-1-2020.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_1_2020.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 0.4.0.2042.1.7
                Policy: 1.3.6.1.4.1.4788.2.202.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl
            X509v3 Subject Key Identifier:
                CB:49:AD:F9:51:23:D0:46:EF:F3:69:92:FD:BA:6C:E0:80:A6:9C:D6
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 498F683D2BA40AC20A43E80C5B7D267F443E15EB896B616B3A50B70BFBE4E440
    SPKI SHA256: A3C1FD49FB595619FD8E6CB4B70CD7E42F25F07E6294298F233FB9C095B2BAF9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2
- AIA OCSP: http://d-trust-ev-root-ca-1-2020.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_1_2020.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST WE384 CA 1-20-22 2026

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST WE384 CA 1-20-22 2026
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 1 2020
- Serial: 73286AB32CCD33705A7CF0E9959BC3E4
- SHA-256: F67C55BF9341E6C55043AC6B6C784C69C21AB8CF15D538F5372701792B0192FF
- SPKI SHA-256: 10DF3C426454B5D08831D38CAA674796C7C31AC9B0CCDB9B9C498495BAE5AAB1
- Validity: 2026-07-17 to 2029-07-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://d-trust-ev-root-ca-1-2020.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            73:28:6a:b3:2c:cd:33:70:5a:7c:f0:e9:95:9b:c3:e4
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST EV Root CA 1 2020
        Validity
            Not Before: Jul 17 08:00:59 2026 GMT
            Not After : Jul 16 08:00:58 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST WE384 CA 1-20-22 2026
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                7F:10:01:16:37:3A:A4:28:E4:50:F8:A4:F7:EC:6B:32:B6:FE:E9:8B
            Authority Information Access:
                OCSP - URI:http://d-trust-ev-root-ca-1-2020.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_1_2020.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 0.4.0.2042.1.7
                Policy: 1.3.6.1.4.1.4788.2.202.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl
            X509v3 Subject Key Identifier:
                39:04:07:33:44:3E:9D:CC:C7:07:45:9A:0F:16:AE:38:2B:9F:89:FE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F67C55BF9341E6C55043AC6B6C784C69C21AB8CF15D538F5372701792B0192FF
    SPKI SHA256: 10DF3C426454B5D08831D38CAA674796C7C31AC9B0CCDB9B9C498495BAE5AAB1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2
- AIA OCSP: http://d-trust-ev-root-ca-1-2020.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_1_2020.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST WR4096 CA 2-23-11 2026

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST WR4096 CA 2-23-11 2026
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 2 2023
- Serial: 5620B76E2DA4A54E405DE1FE7981374D
- SHA-256: 8544BB6E73BC3724ABE0031509F16FBEA48A43B87E61291D4DB4098312E8661A
- SPKI SHA-256: AA29F7B1405F15305D50E8D66B02500F1DE9754C756A11B40CDE7E6A50228A6B
- Validity: 2026-03-25 to 2029-03-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 0.4.0.2042.1.6, 1.3.6.1.4.1.4788.2.202.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            56:20:b7:6e:2d:a4:a5:4e:40:5d:e1:fe:79:81:37:4d
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST EV Root CA 2 2023
        Validity
            Not Before: Mar 25 12:32:37 2026 GMT
            Not After : Mar 24 12:31:37 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST WR4096 CA 2-23-11 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                AA:FC:91:10:1B:87:91:5F:16:B9:BF:4F:4B:91:5E:00:1C:B1:32:80
            Authority Information Access:
                OCSP - URI:http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_2_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 0.4.0.2042.1.6
                Policy: 1.3.6.1.4.1.4788.2.202.3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
            X509v3 Subject Key Identifier:
                25:D1:B5:04:F8:DE:16:89:BD:1A:B2:0C:75:71:14:46:C6:18:1C:FD
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 8544BB6E73BC3724ABE0031509F16FBEA48A43B87E61291D4DB4098312E8661A
    SPKI SHA256: AA29F7B1405F15305D50E8D66B02500F1DE9754C756A11B40CDE7E6A50228A6B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 0.4.0.2042.1.6, 1.3.6.1.4.1.4788.2.202.3
- AIA OCSP: http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_2_2023.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST WR4096 CA 2-23-12 2026

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST WR4096 CA 2-23-12 2026
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 2 2023
- Serial: 7B6447BD465A335AB32E998867212DC8
- SHA-256: B411571170E4572B020E7C799B6FA260C21251298D9A0ECAC12D0CADFE5AB467
- SPKI SHA-256: 93E7DE1789ABC752CE4E4C4193FA54D8A71D0FD4F25601B64E548F2AED7EF95B
- Validity: 2026-03-25 to 2029-03-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_wr4096_ca_2-23-12_2026.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_wr4096_ca_2-23-12_2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:64:47:bd:46:5a:33:5a:b3:2e:99:88:67:21:2d:c8
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST EV Root CA 2 2023
        Validity
            Not Before: Mar 25 12:42:27 2026 GMT
            Not After : Mar 24 12:41:27 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST WR4096 CA 2-23-12 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                AA:FC:91:10:1B:87:91:5F:16:B9:BF:4F:4B:91:5E:00:1C:B1:32:80
            Authority Information Access:
                OCSP - URI:http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_2_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 0.4.0.2042.1.7
                Policy: 1.3.6.1.4.1.4788.2.202.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
            X509v3 Subject Key Identifier:
                37:92:FC:D5:A4:61:60:E4:1A:6C:0E:21:54:28:81:4A:30:74:62:FC
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: B411571170E4572B020E7C799B6FA260C21251298D9A0ECAC12D0CADFE5AB467
    SPKI SHA256: 93E7DE1789ABC752CE4E4C4193FA54D8A71D0FD4F25601B64E548F2AED7EF95B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2
- AIA OCSP: http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_2_2023.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST WR4096 CA 2-23-13 2026

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST WR4096 CA 2-23-13 2026
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 2 2023
- Serial: 644055C45AC9A07C75B06431BE50E772
- SHA-256: 8FFFB801EF8D22AE389F7C58C550E3D389F7D456EB1B25C0CE7A9FE584A38804
- SPKI SHA-256: DCB9CF01E6C54A440A453A19681D19E25B91BD6469B0500FBC233411821763EC
- Validity: 2026-03-25 to 2029-03-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.2042.1.4, 1.3.6.1.4.1.4788.2.202.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            64:40:55:c4:5a:c9:a0:7c:75:b0:64:31:be:50:e7:72
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST EV Root CA 2 2023
        Validity
            Not Before: Mar 25 12:46:44 2026 GMT
            Not After : Mar 24 12:45:44 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST WR4096 CA 2-23-13 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                AA:FC:91:10:1B:87:91:5F:16:B9:BF:4F:4B:91:5E:00:1C:B1:32:80
            Authority Information Access:
                OCSP - URI:http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_2_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 0.4.0.2042.1.4
                Policy: 1.3.6.1.4.1.4788.2.202.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
            X509v3 Subject Key Identifier:
                92:CB:02:20:C4:C2:16:E4:0C:6A:E7:63:C1:40:4C:55:7D:7C:CA:AD
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 8FFFB801EF8D22AE389F7C58C550E3D389F7D456EB1B25C0CE7A9FE584A38804
    SPKI SHA256: DCB9CF01E6C54A440A453A19681D19E25B91BD6469B0500FBC233411821763EC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.2042.1.4, 1.3.6.1.4.1.4788.2.202.1
- AIA OCSP: http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_2_2023.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST WR4096 CA 2-23-21 2026

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST WR4096 CA 2-23-21 2026
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 2 2023
- Serial: 5C95FCC489DB385A1C0A835EB0218A68
- SHA-256: F0BAC64EB900BACCF46F8CF36009984399C02AD02532819F0885236C3F10B7A3
- SPKI SHA-256: 396125C1C8038E671FB0C83F89B0083FE154D838A98F14A9858D762DA7BC9C84
- Validity: 2026-04-15 to 2029-04-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 0.4.0.2042.1.6, 1.3.6.1.4.1.4788.2.202.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5c:95:fc:c4:89:db:38:5a:1c:0a:83:5e:b0:21:8a:68
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST EV Root CA 2 2023
        Validity
            Not Before: Apr 15 08:22:43 2026 GMT
            Not After : Apr 14 08:21:43 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST WR4096 CA 2-23-21 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                AA:FC:91:10:1B:87:91:5F:16:B9:BF:4F:4B:91:5E:00:1C:B1:32:80
            Authority Information Access:
                OCSP - URI:http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_2_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 0.4.0.2042.1.6
                Policy: 1.3.6.1.4.1.4788.2.202.3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
            X509v3 Subject Key Identifier:
                46:CA:CD:61:C6:7B:40:54:BF:97:91:07:E9:4A:4B:B4:99:87:34:8A
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: F0BAC64EB900BACCF46F8CF36009984399C02AD02532819F0885236C3F10B7A3
    SPKI SHA256: 396125C1C8038E671FB0C83F89B0083FE154D838A98F14A9858D762DA7BC9C84
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 0.4.0.2042.1.6, 1.3.6.1.4.1.4788.2.202.3
- AIA OCSP: http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_2_2023.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST WR4096 CA 2-23-22 2026

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST WR4096 CA 2-23-22 2026
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 2 2023
- Serial: 60BEA24655B3E31B2B2C0E420CC8A16C
- SHA-256: 7C467DDCD791AE851008626548E940C251BD59D76BA5013BDF3D3FA2FDCE39E6
- SPKI SHA-256: E305CC870FC15F4729854A524F4B604ABF5C75429558D09DC12FA5E44BF8C0C1
- Validity: 2026-04-15 to 2029-04-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/d-trust_wr4096_ca_2-23-22_2026.crl, http://cdn.d-trust-cloudcrl.net/crl/d-trust_wr4096_ca_2-23-22_2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            60:be:a2:46:55:b3:e3:1b:2b:2c:0e:42:0c:c8:a1:6c
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST EV Root CA 2 2023
        Validity
            Not Before: Apr 15 08:28:43 2026 GMT
            Not After : Apr 14 08:27:43 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST WR4096 CA 2-23-22 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                AA:FC:91:10:1B:87:91:5F:16:B9:BF:4F:4B:91:5E:00:1C:B1:32:80
            Authority Information Access:
                OCSP - URI:http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_2_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 0.4.0.2042.1.7
                Policy: 1.3.6.1.4.1.4788.2.202.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
            X509v3 Subject Key Identifier:
                53:9D:33:29:F1:C9:A5:67:CD:AE:9E:FA:13:41:DE:F4:13:0A:96:EA
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 7C467DDCD791AE851008626548E940C251BD59D76BA5013BDF3D3FA2FDCE39E6
    SPKI SHA256: E305CC870FC15F4729854A524F4B604ABF5C75429558D09DC12FA5E44BF8C0C1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2
- AIA OCSP: http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_2_2023.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### D-TRUST WR4096 CA 2-23-23 2026

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST WR4096 CA 2-23-23 2026
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST EV Root CA 2 2023
- Serial: 4D744E67A4705588ACF9792AC01AAED8
- SHA-256: AFC555603AC30732A1662ED1872C241409FB17E3720E57892E7FABC95543D09A
- SPKI SHA-256: 341C99967BCB4754A538F7E9BFFF856EE370718B6ADB49638B3D8B60F1A47E43
- Validity: 2026-04-15 to 2029-04-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.2042.1.4, 1.3.6.1.4.1.4788.2.202.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4d:74:4e:67:a4:70:55:88:ac:f9:79:2a:c0:1a:ae:d8
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST EV Root CA 2 2023
        Validity
            Not Before: Apr 15 08:33:00 2026 GMT
            Not After : Apr 14 08:32:00 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = D-TRUST WR4096 CA 2-23-23 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                AA:FC:91:10:1B:87:91:5F:16:B9:BF:4F:4B:91:5E:00:1C:B1:32:80
            Authority Information Access:
                OCSP - URI:http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_2_2023.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 0.4.0.2042.1.4
                Policy: 1.3.6.1.4.1.4788.2.202.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
            X509v3 Subject Key Identifier:
                D9:85:35:32:36:A1:BB:B2:DB:A1:9D:B5:3B:47:F5:F3:03:0B:AD:2E
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: AFC555603AC30732A1662ED1872C241409FB17E3720E57892E7FABC95543D09A
    SPKI SHA256: 341C99967BCB4754A538F7E9BFFF856EE370718B6ADB49638B3D8B60F1A47E43
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.2042.1.4, 1.3.6.1.4.1.4788.2.202.1
- AIA OCSP: http://d-trust-ev-root-ca-2-2023.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_EV_Root_CA_2_2023.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### E.ON CA 2 2013 XXI

- Subject: countryName=DE, organizationName=E.ON SE, organizationalUnitName=CA, commonName=E.ON CA 2 2013 XXI
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=E.ON Group CA 2 2013
- Serial: 57641982B1CBE2912D9842279F1AC95A
- SHA-256: 43B3986A9908B9B0D76C78AA877DDC1B8C8E6AC2F441B9767E68DF5ECF096438
- SPKI SHA-256: 3FD1C73D79A36B728F59098511E9262D64CFDC20FCA196F98057FB04EAA7CAEA
- Validity: 2024-05-15 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/eon_ca_2_2013_xxi.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4788.2.210.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://eon-group-ca-2-2013.ocsp.d-trust.net
- CRL DP: http://pki.intranet.eon.com/crls/EON_Group_CA_2_2013.crl, http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            57:64:19:82:b1:cb:e2:91:2d:98:42:27:9f:1a:c9:5a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = E.ON Group CA 2 2013
        Validity
            Not Before: May 15 07:50:00 2024 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = E.ON SE, OU = CA, CN = E.ON CA 2 2013 XXI
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Authority Key Identifier:
                2E:EE:1F:F1:DB:C1:D6:72:DD:42:D5:35:ED:CF:2E:51:BA:61:B2:65
            Authority Information Access:
                OCSP - URI:http://eon-group-ca-2-2013.ocsp.d-trust.net
                CA Issuers - URI:http://pki.intranet.eon.com/cacerts/EON_Group_CA_2_2013.crt
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/EON_Group_CA_2_2013.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.4788.2.210.1
                  CPS: https://www.eon.com/pki
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.intranet.eon.com/crls/EON_Group_CA_2_2013.crl
                Full Name:
                  URI:http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl
            X509v3 Subject Key Identifier:
                1D:6B:D8:4B:31:57:93:D0:79:ED:7E:3A:1E:E1:61:33:1A:8F:33:27
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 43B3986A9908B9B0D76C78AA877DDC1B8C8E6AC2F441B9767E68DF5ECF096438
    SPKI SHA256: 3FD1C73D79A36B728F59098511E9262D64CFDC20FCA196F98057FB04EAA7CAEA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4788.2.210.1
- AIA OCSP: http://eon-group-ca-2-2013.ocsp.d-trust.net
- AIA CA Issuers: http://pki.intranet.eon.com/cacerts/EON_Group_CA_2_2013.crt, http://www.d-trust.net/cgi-bin/EON_Group_CA_2_2013.crt
- CRL Distribution Points: http://pki.intranet.eon.com/crls/EON_Group_CA_2_2013.crl, http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### E.ON CA 2 2013 XXI

- Subject: countryName=DE, organizationName=E.ON SE, organizationalUnitName=CA, commonName=E.ON CA 2 2013 XXI
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=E.ON Group CA 2 2013
- Serial: 525A901BD329BB39B1EE474D86C400FF
- SHA-256: 41D1CF86CDE9DB5EDDC90A9DE0A4F6014E997DDA271D5B3766E1E3214DCCD9C7
- SPKI SHA-256: 3FD1C73D79A36B728F59098511E9262D64CFDC20FCA196F98057FB04EAA7CAEA
- Validity: 2024-07-11 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/eon_ca_2_2013_xxi.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4788.2.210.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://eon-group-ca-2-2013.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:5a:90:1b:d3:29:bb:39:b1:ee:47:4d:86:c4:00:ff
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = E.ON Group CA 2 2013
        Validity
            Not Before: Jul 11 09:00:00 2024 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = E.ON SE, OU = CA, CN = E.ON CA 2 2013 XXI
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Authority Key Identifier:
                2E:EE:1F:F1:DB:C1:D6:72:DD:42:D5:35:ED:CF:2E:51:BA:61:B2:65
            Authority Information Access:
                OCSP - URI:http://eon-group-ca-2-2013.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/EON_Group_CA_2_2013.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.4788.2.210.1
                  CPS: https://www.eon.com/pki
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl
            X509v3 Subject Key Identifier:
                1D:6B:D8:4B:31:57:93:D0:79:ED:7E:3A:1E:E1:61:33:1A:8F:33:27
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 41D1CF86CDE9DB5EDDC90A9DE0A4F6014E997DDA271D5B3766E1E3214DCCD9C7
    SPKI SHA256: 3FD1C73D79A36B728F59098511E9262D64CFDC20FCA196F98057FB04EAA7CAEA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4788.2.210.1
- AIA OCSP: http://eon-group-ca-2-2013.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/EON_Group_CA_2_2013.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### E.ON CA 2 2013 XXI

- Subject: countryName=DE, organizationName=E.ON SE, organizationalUnitName=CA, commonName=E.ON CA 2 2013 XXI
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=E.ON Group CA 2 2013
- Serial: 101CA6
- SHA-256: 8B1698B51BF6EF2C31C553E6FF7A7734901806BCC87704182D2293183348B334
- SPKI SHA-256: 3FD1C73D79A36B728F59098511E9262D64CFDC20FCA196F98057FB04EAA7CAEA
- Validity: 2013-12-17 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/eon_ca_2_2013_xxi.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.210.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://eon-group-ca-2-2013.ocsp.d-trust.net
- CRL DP: http://pki.intranet.eon.com/crls/EON_Group_CA_2_2013.crl, http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl, ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1055910 (0x101ca6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = E.ON Group CA 2 2013
        Validity
            Not Before: Dec 17 13:07:09 2013 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = E.ON SE, OU = CA, CN = E.ON CA 2 2013 XXI
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                2E:EE:1F:F1:DB:C1:D6:72:DD:42:D5:35:ED:CF:2E:51:BA:61:B2:65
            Authority Information Access:
                OCSP - URI:http://eon-group-ca-2-2013.ocsp.d-trust.net
                CA Issuers - URI:http://pki.intranet.eon.com/cacerts/EON_Group_CA_2_2013.crt
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/EON_Group_CA_2_2013.crt
                CA Issuers - URI:ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013,ou=ca,o=eon,c=de?cACertificate?base?
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.210.1
                  CPS: http://www.eon.com/pki
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.intranet.eon.com/crls/EON_Group_CA_2_2013.crl
                Full Name:
                  URI:http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl
                Full Name:
                  URI:ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013,ou=ca,o=eon,c=de?certificateRevocationList?base?
            X509v3 Subject Key Identifier:
                1D:6B:D8:4B:31:57:93:D0:79:ED:7E:3A:1E:E1:61:33:1A:8F:33:27
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8B1698B51BF6EF2C31C553E6FF7A7734901806BCC87704182D2293183348B334
    SPKI SHA256: 3FD1C73D79A36B728F59098511E9262D64CFDC20FCA196F98057FB04EAA7CAEA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.210.1
- AIA OCSP: http://eon-group-ca-2-2013.ocsp.d-trust.net
- AIA CA Issuers: http://pki.intranet.eon.com/cacerts/EON_Group_CA_2_2013.crt, http://www.d-trust.net/cgi-bin/EON_Group_CA_2_2013.crt, ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013
- CRL Distribution Points: http://pki.intranet.eon.com/crls/EON_Group_CA_2_2013.crl, http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl, ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### E.ON CA 2 2013 XXII

- Subject: countryName=DE, organizationName=E.ON SE, organizationalUnitName=CA, commonName=E.ON CA 2 2013 XXII
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=E.ON Group CA 2 2013
- Serial: 101CAA
- SHA-256: B2B7C755C80FBE20E2134A620157A53B5B0724B6947B4EED1CA9DF7951FC5D44
- SPKI SHA-256: 12966CB7932FA4BD56018A8CBAC0E92245B5C98245919D0DF539BB5201687CD8
- Validity: 2013-12-17 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/eon_ca_2_2013_xxii.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.210.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://eon-group-ca-2-2013.ocsp.d-trust.net
- CRL DP: http://pki.intranet.eon.com/crls/EON_Group_CA_2_2013.crl, http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl, ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1055914 (0x101caa)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = E.ON Group CA 2 2013
        Validity
            Not Before: Dec 17 13:15:09 2013 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = E.ON SE, OU = CA, CN = E.ON CA 2 2013 XXII
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                2E:EE:1F:F1:DB:C1:D6:72:DD:42:D5:35:ED:CF:2E:51:BA:61:B2:65
            Authority Information Access:
                OCSP - URI:http://eon-group-ca-2-2013.ocsp.d-trust.net
                CA Issuers - URI:http://pki.intranet.eon.com/cacerts/EON_Group_CA_2_2013.crt
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/EON_Group_CA_2_2013.crt
                CA Issuers - URI:ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013,ou=ca,o=eon,c=de?cACertificate?base?
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.210.1
                  CPS: http://www.eon.com/pki
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.intranet.eon.com/crls/EON_Group_CA_2_2013.crl
                Full Name:
                  URI:http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl
                Full Name:
                  URI:ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013,ou=ca,o=eon,c=de?certificateRevocationList?base?
            X509v3 Subject Key Identifier:
                74:E8:CA:8B:AC:0D:0A:68:45:E4:D7:0D:73:CB:49:93:5E:42:03:AC
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B2B7C755C80FBE20E2134A620157A53B5B0724B6947B4EED1CA9DF7951FC5D44
    SPKI SHA256: 12966CB7932FA4BD56018A8CBAC0E92245B5C98245919D0DF539BB5201687CD8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.210.1
- AIA OCSP: http://eon-group-ca-2-2013.ocsp.d-trust.net
- AIA CA Issuers: http://pki.intranet.eon.com/cacerts/EON_Group_CA_2_2013.crt, http://www.d-trust.net/cgi-bin/EON_Group_CA_2_2013.crt, ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013
- CRL Distribution Points: http://pki.intranet.eon.com/crls/EON_Group_CA_2_2013.crl, http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl, ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### E.ON CA 2 2013 XXIII

- Subject: countryName=DE, organizationName=E.ON SE, organizationalUnitName=CA, commonName=E.ON CA 2 2013 XXIII
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=E.ON Group CA 2 2013
- Serial: 101CAB
- SHA-256: 99CADFF0B43B45405D471AB7F04817B04925D603007A57CA1BABA48BC8721BF6
- SPKI SHA-256: 32072111F860DEE7DFAD21BCAEB7C40AFA550DFF2F7428E1EE51D4012499E2E6
- Validity: 2013-12-17 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/eon_ca_2_2013_xxiii.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.210.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://eon-group-ca-2-2013.ocsp.d-trust.net
- CRL DP: http://pki.intranet.eon.com/crls/EON_Group_CA_2_2013.crl, http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl, ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1055915 (0x101cab)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = E.ON Group CA 2 2013
        Validity
            Not Before: Dec 17 13:35:09 2013 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = E.ON SE, OU = CA, CN = E.ON CA 2 2013 XXIII
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                2E:EE:1F:F1:DB:C1:D6:72:DD:42:D5:35:ED:CF:2E:51:BA:61:B2:65
            Authority Information Access:
                OCSP - URI:http://eon-group-ca-2-2013.ocsp.d-trust.net
                CA Issuers - URI:http://pki.intranet.eon.com/cacerts/EON_Group_CA_2_2013.crt
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/EON_Group_CA_2_2013.crt
                CA Issuers - URI:ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013,ou=ca,o=eon,c=de?cACertificate?base?
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.210.1
                  CPS: http://www.eon.com/pki
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.intranet.eon.com/crls/EON_Group_CA_2_2013.crl
                Full Name:
                  URI:http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl
                Full Name:
                  URI:ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013,ou=ca,o=eon,c=de?certificateRevocationList?base?
            X509v3 Subject Key Identifier:
                47:A7:0B:06:AC:D5:7A:25:92:72:F5:90:16:9F:64:6D:0F:5B:62:33
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 99CADFF0B43B45405D471AB7F04817B04925D603007A57CA1BABA48BC8721BF6
    SPKI SHA256: 32072111F860DEE7DFAD21BCAEB7C40AFA550DFF2F7428E1EE51D4012499E2E6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.210.1
- AIA OCSP: http://eon-group-ca-2-2013.ocsp.d-trust.net
- AIA CA Issuers: http://pki.intranet.eon.com/cacerts/EON_Group_CA_2_2013.crt, http://www.d-trust.net/cgi-bin/EON_Group_CA_2_2013.crt, ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013
- CRL Distribution Points: http://pki.intranet.eon.com/crls/EON_Group_CA_2_2013.crl, http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl, ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### E.ON CA 2 2013 XXIII

- Subject: countryName=DE, organizationName=E.ON SE, organizationalUnitName=CA, commonName=E.ON CA 2 2013 XXIII
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=E.ON Group CA 2 2013
- Serial: 4B41501A1D898D4AA6EF41BB1A37B257
- SHA-256: 0AB43E7D481D24B216412DEE945D40D73FA2596404172A8C3039BF5E97FD1EF8
- SPKI SHA-256: 32072111F860DEE7DFAD21BCAEB7C40AFA550DFF2F7428E1EE51D4012499E2E6
- Validity: 2024-07-11 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/eon_ca_2_2013_xxiii.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4788.2.210.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://eon-group-ca-2-2013.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4b:41:50:1a:1d:89:8d:4a:a6:ef:41:bb:1a:37:b2:57
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = E.ON Group CA 2 2013
        Validity
            Not Before: Jul 11 09:10:00 2024 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = E.ON SE, OU = CA, CN = E.ON CA 2 2013 XXIII
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Authority Key Identifier:
                2E:EE:1F:F1:DB:C1:D6:72:DD:42:D5:35:ED:CF:2E:51:BA:61:B2:65
            Authority Information Access:
                OCSP - URI:http://eon-group-ca-2-2013.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/EON_Group_CA_2_2013.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.4788.2.210.1
                  CPS: https://www.eon.com/pki
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl
            X509v3 Subject Key Identifier:
                47:A7:0B:06:AC:D5:7A:25:92:72:F5:90:16:9F:64:6D:0F:5B:62:33
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0AB43E7D481D24B216412DEE945D40D73FA2596404172A8C3039BF5E97FD1EF8
    SPKI SHA256: 32072111F860DEE7DFAD21BCAEB7C40AFA550DFF2F7428E1EE51D4012499E2E6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4788.2.210.1
- AIA OCSP: http://eon-group-ca-2-2013.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/EON_Group_CA_2_2013.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### E.ON CA 2 2013 XXIII

- Subject: countryName=DE, organizationName=E.ON SE, organizationalUnitName=CA, commonName=E.ON CA 2 2013 XXIII
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=E.ON Group CA 2 2013
- Serial: 79C689DD35099E0E9D43BA176D4CCAD4
- SHA-256: 6F4EDF5918B4C2A7B3121333F757FFCB0C83EF8C821A10EF47228EFCEDE168D9
- SPKI SHA-256: 32072111F860DEE7DFAD21BCAEB7C40AFA550DFF2F7428E1EE51D4012499E2E6
- Validity: 2024-05-15 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/eon_ca_2_2013_xxiii.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4788.2.210.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://e.on-group-ca-2-2013.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/e.on_group_ca_2_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:c6:89:dd:35:09:9e:0e:9d:43:ba:17:6d:4c:ca:d4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = E.ON Group CA 2 2013
        Validity
            Not Before: May 15 08:30:00 2024 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = E.ON SE, OU = CA, CN = E.ON CA 2 2013 XXIII
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Authority Key Identifier:
                2E:EE:1F:F1:DB:C1:D6:72:DD:42:D5:35:ED:CF:2E:51:BA:61:B2:65
            Authority Information Access:
                OCSP - URI:http://e.on-group-ca-2-2013.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/E.ON_Group_CA_2_2013.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.4788.2.210.1
                  CPS: https://www.eon.com/pki
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/e.on_group_ca_2_2013.crl
            X509v3 Subject Key Identifier:
                47:A7:0B:06:AC:D5:7A:25:92:72:F5:90:16:9F:64:6D:0F:5B:62:33
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6F4EDF5918B4C2A7B3121333F757FFCB0C83EF8C821A10EF47228EFCEDE168D9
    SPKI SHA256: 32072111F860DEE7DFAD21BCAEB7C40AFA550DFF2F7428E1EE51D4012499E2E6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.4788.2.210.1
- AIA OCSP: http://e.on-group-ca-2-2013.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/E.ON_Group_CA_2_2013.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/e.on_group_ca_2_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### E.ON CA 3 2024 XXI

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=E.ON CA 3 2024 XXI, organizationIdentifier=VATDE-202620438
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 2 2022
- Serial: 5C100900A70B58152EDFF3DAB33CC089
- SHA-256: 7C14C09B23D7527E60C65B027D7EA994C6C1B70B60A026078BFD1C5B262DD162
- SPKI SHA-256: 4739483C203BFEE12E5A916D1E686DB0C0DFA8FDCCEDBEC6E5820D75ECF44244
- Validity: 2024-10-21 to 2036-10-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www1.d-trust.net/pdf-download/EON_SE_PKI_CPS_v3.6.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/eon_ca_3_2024_xxi.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.3, 0.4.0.2042.1.1, 1.3.6.1.4.1.4788.2.210.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5c:10:09:00:a7:0b:58:15:2e:df:f3:da:b3:3c:c0:89
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-Trust SBR Root CA 2 2022
        Validity
            Not Before: Oct 21 09:53:57 2024 GMT
            Not After : Oct 21 09:53:57 2036 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = E.ON CA 3 2024 XXI, organizationIdentifier = VATDE-202620438
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Authority Key Identifier:
                5D:B3:80:94:1B:E5:86:BF:68:BA:14:34:A4:F6:EE:6D:F2:DD:DF:E7
            Authority Information Access:
                OCSP - URI:http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_2_2022.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.3
                Policy: 0.4.0.2042.1.1
                Policy: 1.3.6.1.4.1.4788.2.210.2
                  CPS: https://www.eon.com/pki
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
            X509v3 Subject Key Identifier:
                CB:DF:07:3B:ED:D8:30:AE:F3:D5:49:FC:0C:AA:3F:60:89:0B:41:FE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 7C14C09B23D7527E60C65B027D7EA994C6C1B70B60A026078BFD1C5B262DD162
    SPKI SHA256: 4739483C203BFEE12E5A916D1E686DB0C0DFA8FDCCEDBEC6E5820D75ECF44244
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.3, 0.4.0.2042.1.1, 1.3.6.1.4.1.4788.2.210.2
- AIA OCSP: http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_2_2022.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### E.ON CA 3 2024 XXIII

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=E.ON CA 3 2024 XXIII, organizationIdentifier=VATDE-202620438
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-Trust SBR Root CA 2 2022
- Serial: 77298C15EAD91DA5906C2403EC2C738A
- SHA-256: 116FAFBFFD3579DE5C4205B2847FD3A47D3DF6F794F1296CDB8D1CFE55AEC8B0
- SPKI SHA-256: 9818746C5C4EBB5E5791AF40AEA273BEFB3693AE05B34E6F8C2055A21172B60C
- Validity: 2024-10-21 to 2036-10-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA512

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www1.d-trust.net/pdf-download/EON_SE_PKI_CPS_v3.6.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/eon_ca_3_2024_xxiii.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.210.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
- CRL DP: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:29:8c:15:ea:d9:1d:a5:90:6c:24:03:ec:2c:73:8a
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-Trust SBR Root CA 2 2022
        Validity
            Not Before: Oct 21 10:01:20 2024 GMT
            Not After : Oct 21 10:01:20 2036 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = E.ON CA 3 2024 XXIII, organizationIdentifier = VATDE-202620438
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Authority Key Identifier:
                5D:B3:80:94:1B:E5:86:BF:68:BA:14:34:A4:F6:EE:6D:F2:DD:DF:E7
            Authority Information Access:
                OCSP - URI:http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_2_2022.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.2
                Policy: 0.4.0.2042.1.3
                Policy: 1.3.6.1.4.1.4788.2.210.1
                  CPS: https://www.eon.com/pki
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
            X509v3 Subject Key Identifier:
                EF:CF:78:C0:C5:25:BF:E1:6F:17:FD:C5:EE:85:33:60:20:74:87:82
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha512WithRSAEncryption
    SHA256 Fingerprint: 116FAFBFFD3579DE5C4205B2847FD3A47D3DF6F794F1296CDB8D1CFE55AEC8B0
    SPKI SHA256: 9818746C5C4EBB5E5791AF40AEA273BEFB3693AE05B34E6F8C2055A21172B60C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.2, 0.4.0.2042.1.3, 1.3.6.1.4.1.4788.2.210.1
- AIA OCSP: http://d-trust-sbr-root-ca-2-2022.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_2_2022.crt
- CRL Distribution Points: http://crl.d-trust.net/crl/d-trust_sbr_root_ca_2_2022.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### E.ON Group CA 2 2013

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=E.ON Group CA 2 2013
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root CA 3 2013
- Serial: 0FE43B
- SHA-256: 43247EF5A09A0867BA4A7E1716463577AAD6EFA057BFF763B43FD2A979608FE2
- SPKI SHA-256: E15B6823E684BC0821271BDF03B0546254B611F0F1EC8E71E54F93EA4266925B
- Validity: 2013-12-17 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.d-trust.net/internet/files/D-TRUST_CP.pdf, https://www1.d-trust.net/pdf-download/EON_SE_PKI_CPS_v3.6.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.d-trust.net/crl/eon_group_ca_2_2013.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.200.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://root-ca-3-2013.ocsp.d-trust.net
- CRL DP: http://pki.intranet.eon.com/crls/D-TRUST_Root_CA_3_2013.crl, http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl, ldap://cdp-ldap.intranet.eon.com/cn=D-TRUST%20Root%20CA%203%202013
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1041467 (0xfe43b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root CA 3 2013
        Validity
            Not Before: Dec 17 12:49:10 2013 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = E.ON Group CA 2 2013
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                3F:90:C8:7D:C7:15:6F:F3:24:8F:A9:C3:2F:4B:A2:0F:21:B2:2F:E7
            Authority Information Access:
                OCSP - URI:http://root-ca-3-2013.ocsp.d-trust.net
                CA Issuers - URI:http://pki.intranet.eon.com/cacerts/D-TRUST_Root_CA_3_2013.crt
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_Root_CA_3_2013.crt
                CA Issuers - URI:ldap://cdp-ldap.intranet.eon.com/cn=D-TRUST%20Root%20CA%203%202013,ou=ca,o=eon,c=de?cACertificate?base?
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.200.1
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_Root_PKI_CPS.pdf
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.intranet.eon.com/crls/D-TRUST_Root_CA_3_2013.crl
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
                Full Name:
                  URI:ldap://cdp-ldap.intranet.eon.com/cn=D-TRUST%20Root%20CA%203%202013,ou=ca,o=eon,c=de?certificateRevocationList?base?
            X509v3 Subject Key Identifier:
                2E:EE:1F:F1:DB:C1:D6:72:DD:42:D5:35:ED:CF:2E:51:BA:61:B2:65
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 43247EF5A09A0867BA4A7E1716463577AAD6EFA057BFF763B43FD2A979608FE2
    SPKI SHA256: E15B6823E684BC0821271BDF03B0546254B611F0F1EC8E71E54F93EA4266925B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.200.1
- AIA OCSP: http://root-ca-3-2013.ocsp.d-trust.net
- AIA CA Issuers: http://pki.intranet.eon.com/cacerts/D-TRUST_Root_CA_3_2013.crt, http://www.d-trust.net/cgi-bin/D-TRUST_Root_CA_3_2013.crt, ldap://cdp-ldap.intranet.eon.com/cn=D-TRUST%20Root%20CA%203%202013
- CRL Distribution Points: http://pki.intranet.eon.com/crls/D-TRUST_Root_CA_3_2013.crl, http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl, ldap://cdp-ldap.intranet.eon.com/cn=D-TRUST%20Root%20CA%203%202013
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Partner CA 2 2013 XXIV

- Subject: countryName=DE, organizationName=D-Trust GmbH, organizationalUnitName=CA, commonName=Partner CA 2 2013 XXIV
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=E.ON Group CA 2 2013
- Serial: 101CAC
- SHA-256: A099851198F66AA47D11D1FF42A6876E7F328C22184BC0B66559AF5A51459511
- SPKI SHA-256: 314FC2C03C33714B804DDB67DB6FC0ADCBF96EF7BEC7288ADE2F864B6418EBEC
- Validity: 2013-12-17 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.d-trust.net/crl/partner_ca_2_2013_xxiv.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.210.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://eon-group-ca-2-2013.ocsp.d-trust.net
- CRL DP: http://pki.intranet.eon.com/crls/EON_Group_CA_2_2013.crl, http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl, ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1055916 (0x101cac)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = E.ON Group CA 2 2013
        Validity
            Not Before: Dec 17 13:45:09 2013 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = D-Trust GmbH, OU = CA, CN = Partner CA 2 2013 XXIV
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                2E:EE:1F:F1:DB:C1:D6:72:DD:42:D5:35:ED:CF:2E:51:BA:61:B2:65
            Authority Information Access:
                OCSP - URI:http://eon-group-ca-2-2013.ocsp.d-trust.net
                CA Issuers - URI:http://pki.intranet.eon.com/cacerts/EON_Group_CA_2_2013.crt
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/EON_Group_CA_2_2013.crt
                CA Issuers - URI:ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013,ou=ca,o=eon,c=de?cACertificate?base?
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.210.1
                  CPS: http://www.eon.com/pki
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.intranet.eon.com/crls/EON_Group_CA_2_2013.crl
                Full Name:
                  URI:http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl
                Full Name:
                  URI:ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013,ou=ca,o=eon,c=de?certificateRevocationList?base?
            X509v3 Subject Key Identifier:
                EA:84:6A:8E:C8:B7:D6:3A:D5:CC:E9:1C:7D:F1:F6:0F:83:45:B7:80
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A099851198F66AA47D11D1FF42A6876E7F328C22184BC0B66559AF5A51459511
    SPKI SHA256: 314FC2C03C33714B804DDB67DB6FC0ADCBF96EF7BEC7288ADE2F864B6418EBEC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.210.1
- AIA OCSP: http://eon-group-ca-2-2013.ocsp.d-trust.net
- AIA CA Issuers: http://pki.intranet.eon.com/cacerts/EON_Group_CA_2_2013.crt, http://www.d-trust.net/cgi-bin/EON_Group_CA_2_2013.crt, ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013
- CRL Distribution Points: http://pki.intranet.eon.com/crls/EON_Group_CA_2_2013.crl, http://crl.d-trust.net/crl/eon_group_ca_2_2013.crl, ldap://cdp-ldap.intranet.eon.com/cn=E.ON%20Group%20CA%202%202013
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Uniper CA 2 2015 XXXI

- Subject: countryName=DE, organizationName=Uniper Holding GmbH, organizationalUnitName=CA, commonName=Uniper CA 2 2015 XXXI
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=Uniper Group CA 2 2015
- Serial: 169A5B
- SHA-256: F471920D5679EE48219F51CBF44F0F22A7305332B869025E26050C5BED762F72
- SPKI SHA-256: 6FE7B039C89B8FD1D567AA0A2E8291D811CF7EF0B5D2990604107C107883DA92
- Validity: 2015-11-12 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.d-trust.net/crl/uniper_ca_2_2015_xxxi.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.212.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://uniper-group-ca-2-2015.ocsp.d-trust.net
- CRL DP: http://pki.intranet.uniper.energy/crls/Uniper_Group_CA_2_2015.crl, http://crl.d-trust.net/crl/uniper_group_ca_2_2015.crl, ldap://cdp-ldap.intranet.uniper.energy/cn=Uniper%20Group%20CA%202%202015
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1481307 (0x169a5b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = Uniper Group CA 2 2015
        Validity
            Not Before: Nov 12 17:46:37 2015 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = Uniper Holding GmbH, OU = CA, CN = Uniper CA 2 2015 XXXI
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                19:8D:DF:60:36:D0:0C:F9:BE:47:DB:C0:BB:A9:80:EC:8A:07:0F:90
            Authority Information Access:
                OCSP - URI:http://uniper-group-ca-2-2015.ocsp.d-trust.net
                CA Issuers - URI:http://pki.intranet.uniper.energy/cacerts/Uniper_Group_CA_2_2015.crt
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/Uniper_Group_CA_2_2015.crt
                CA Issuers - URI:ldap://cdp-ldap.intranet.uniper.energy/cn=Uniper%20Group%20CA%202%202015,ou=ca,o=uniper,c=de?cACertificate?base?
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.212.1
                  CPS: http://www.uniper.energy/pki
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.intranet.uniper.energy/crls/Uniper_Group_CA_2_2015.crl
                Full Name:
                  URI:http://crl.d-trust.net/crl/uniper_group_ca_2_2015.crl
                Full Name:
                  URI:ldap://cdp-ldap.intranet.uniper.energy/cn=Uniper%20Group%20CA%202%202015,ou=ca,o=uniper,c=de?certificateRevocationList?base?
            X509v3 Subject Key Identifier:
                D8:C3:04:0E:55:96:75:63:4C:20:0E:94:5F:2C:1A:D4:43:27:36:03
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F471920D5679EE48219F51CBF44F0F22A7305332B869025E26050C5BED762F72
    SPKI SHA256: 6FE7B039C89B8FD1D567AA0A2E8291D811CF7EF0B5D2990604107C107883DA92
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.212.1
- AIA OCSP: http://uniper-group-ca-2-2015.ocsp.d-trust.net
- AIA CA Issuers: http://pki.intranet.uniper.energy/cacerts/Uniper_Group_CA_2_2015.crt, http://www.d-trust.net/cgi-bin/Uniper_Group_CA_2_2015.crt, ldap://cdp-ldap.intranet.uniper.energy/cn=Uniper%20Group%20CA%202%202015
- CRL Distribution Points: http://pki.intranet.uniper.energy/crls/Uniper_Group_CA_2_2015.crl, http://crl.d-trust.net/crl/uniper_group_ca_2_2015.crl, ldap://cdp-ldap.intranet.uniper.energy/cn=Uniper%20Group%20CA%202%202015
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Uniper CA 2 2015 XXXII

- Subject: countryName=DE, organizationName=Uniper Holding GmbH, organizationalUnitName=CA, commonName=Uniper CA 2 2015 XXXII
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=Uniper Group CA 2 2015
- Serial: 169A5F
- SHA-256: EFA0A2F29EABB43EAD97AD067297656088679C0B2E297C2D898C4F12C9759805
- SPKI SHA-256: 2A82658FC20DC799AA73EAA13A4AA842BB5F6C31F9CD82710887C5012249DB1D
- Validity: 2015-11-12 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.d-trust.net/crl/uniper_ca_2_2015_xxxii.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.212.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://uniper-group-ca-2-2015.ocsp.d-trust.net
- CRL DP: http://pki.intranet.uniper.energy/crls/Uniper_Group_CA_2_2015.crl, http://crl.d-trust.net/crl/uniper_group_ca_2_2015.crl, ldap://cdp-ldap.intranet.uniper.energy/cn=Uniper%20Group%20CA%202%202015
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1481311 (0x169a5f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = Uniper Group CA 2 2015
        Validity
            Not Before: Nov 12 17:56:37 2015 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = Uniper Holding GmbH, OU = CA, CN = Uniper CA 2 2015 XXXII
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                19:8D:DF:60:36:D0:0C:F9:BE:47:DB:C0:BB:A9:80:EC:8A:07:0F:90
            Authority Information Access:
                OCSP - URI:http://uniper-group-ca-2-2015.ocsp.d-trust.net
                CA Issuers - URI:http://pki.intranet.uniper.energy/cacerts/Uniper_Group_CA_2_2015.crt
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/Uniper_Group_CA_2_2015.crt
                CA Issuers - URI:ldap://cdp-ldap.intranet.uniper.energy/cn=Uniper%20Group%20CA%202%202015,ou=ca,o=uniper,c=de?cACertificate?base?
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.212.1
                  CPS: http://www.uniper.energy/pki
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.intranet.uniper.energy/crls/Uniper_Group_CA_2_2015.crl
                Full Name:
                  URI:http://crl.d-trust.net/crl/uniper_group_ca_2_2015.crl
                Full Name:
                  URI:ldap://cdp-ldap.intranet.uniper.energy/cn=Uniper%20Group%20CA%202%202015,ou=ca,o=uniper,c=de?certificateRevocationList?base?
            X509v3 Subject Key Identifier:
                0B:F3:0D:36:07:B9:62:32:10:30:A9:76:53:86:76:60:6B:43:78:4C
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EFA0A2F29EABB43EAD97AD067297656088679C0B2E297C2D898C4F12C9759805
    SPKI SHA256: 2A82658FC20DC799AA73EAA13A4AA842BB5F6C31F9CD82710887C5012249DB1D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.212.1
- AIA OCSP: http://uniper-group-ca-2-2015.ocsp.d-trust.net
- AIA CA Issuers: http://pki.intranet.uniper.energy/cacerts/Uniper_Group_CA_2_2015.crt, http://www.d-trust.net/cgi-bin/Uniper_Group_CA_2_2015.crt, ldap://cdp-ldap.intranet.uniper.energy/cn=Uniper%20Group%20CA%202%202015
- CRL Distribution Points: http://pki.intranet.uniper.energy/crls/Uniper_Group_CA_2_2015.crl, http://crl.d-trust.net/crl/uniper_group_ca_2_2015.crl, ldap://cdp-ldap.intranet.uniper.energy/cn=Uniper%20Group%20CA%202%202015
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Uniper CA 2 2015 XXXIII

- Subject: countryName=DE, organizationName=Uniper Holding GmbH, organizationalUnitName=CA, commonName=Uniper CA 2 2015 XXXIII
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=Uniper Group CA 2 2015
- Serial: 169A60
- SHA-256: 79B9D31504B604293570ECCDC8A92553F937FD823380E560793987037C8B181D
- SPKI SHA-256: 30E95BD124E5D60E2F3C205F91F41E3707630FCF668F505E88DD0E4FCC64062A
- Validity: 2015-11-12 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.d-trust.net/crl/uniper_ca_2_2015_xxxiii.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.212.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://uniper-group-ca-2-2015.ocsp.d-trust.net
- CRL DP: http://pki.intranet.uniper.energy/crls/Uniper_Group_CA_2_2015.crl, http://crl.d-trust.net/crl/uniper_group_ca_2_2015.crl, ldap://cdp-ldap.intranet.uniper.energy/cn=Uniper%20Group%20CA%202%202015
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1481312 (0x169a60)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = Uniper Group CA 2 2015
        Validity
            Not Before: Nov 12 18:09:50 2015 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = Uniper Holding GmbH, OU = CA, CN = Uniper CA 2 2015 XXXIII
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                19:8D:DF:60:36:D0:0C:F9:BE:47:DB:C0:BB:A9:80:EC:8A:07:0F:90
            Authority Information Access:
                OCSP - URI:http://uniper-group-ca-2-2015.ocsp.d-trust.net
                CA Issuers - URI:http://pki.intranet.uniper.energy/cacerts/Uniper_Group_CA_2_2015.crt
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/Uniper_Group_CA_2_2015.crt
                CA Issuers - URI:ldap://cdp-ldap.intranet.uniper.energy/cn=Uniper%20Group%20CA%202%202015,ou=ca,o=uniper,c=de?cACertificate?base?
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.212.1
                  CPS: http://www.uniper.energy/pki
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.intranet.uniper.energy/crls/Uniper_Group_CA_2_2015.crl
                Full Name:
                  URI:http://crl.d-trust.net/crl/uniper_group_ca_2_2015.crl
                Full Name:
                  URI:ldap://cdp-ldap.intranet.uniper.energy/cn=Uniper%20Group%20CA%202%202015,ou=ca,o=uniper,c=de?certificateRevocationList?base?
            X509v3 Subject Key Identifier:
                F9:A7:FA:59:B4:27:90:76:34:2D:23:EC:AD:90:A8:13:4A:A0:A3:0A
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 79B9D31504B604293570ECCDC8A92553F937FD823380E560793987037C8B181D
    SPKI SHA256: 30E95BD124E5D60E2F3C205F91F41E3707630FCF668F505E88DD0E4FCC64062A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.212.1
- AIA OCSP: http://uniper-group-ca-2-2015.ocsp.d-trust.net
- AIA CA Issuers: http://pki.intranet.uniper.energy/cacerts/Uniper_Group_CA_2_2015.crt, http://www.d-trust.net/cgi-bin/Uniper_Group_CA_2_2015.crt, ldap://cdp-ldap.intranet.uniper.energy/cn=Uniper%20Group%20CA%202%202015
- CRL Distribution Points: http://pki.intranet.uniper.energy/crls/Uniper_Group_CA_2_2015.crl, http://crl.d-trust.net/crl/uniper_group_ca_2_2015.crl, ldap://cdp-ldap.intranet.uniper.energy/cn=Uniper%20Group%20CA%202%202015
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Uniper CA 3 2020 XXXI

- Subject: countryName=DE, organizationName=Uniper Holding GmbH, organizationalUnitName=CA, commonName=Uniper CA 3 2020 XXXI
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=Uniper Group CA 3 2020
- Serial: 652417202394B820A7ABB8DA78C11DA4
- SHA-256: 19D99B7FDD7EC707AC3023D72F50D4AB5199AF1FDD3013A96815CBC99B63BFD6
- SPKI SHA-256: 0E978103BC3B7160E6EF2C1EE50A6CA28E472B23588CF08C837D5625E363A696
- Validity: 2020-04-21 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.d-trust.net/crl/uniper_ca_3_2020_xxxi.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4788.2.212.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://uniper-group-ca-3-2020.ocsp.d-trust.net
- CRL DP: http://pkicdp.uniperapps.com/crl/uniper_group_ca_3_2020.crl, http://crl.d-trust.net/crl/uniper_group_ca_3_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            65:24:17:20:23:94:b8:20:a7:ab:b8:da:78:c1:1d:a4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = Uniper Group CA 3 2020
        Validity
            Not Before: Apr 21 10:43:19 2020 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = Uniper Holding GmbH, OU = CA, CN = Uniper CA 3 2020 XXXI
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Authority Key Identifier:
                8C:C6:1E:65:2B:FD:63:DB:80:F8:D4:DD:3D:DA:F0:51:D0:9D:5F:22
            Authority Information Access:
                OCSP - URI:http://uniper-group-ca-3-2020.ocsp.d-trust.net
                CA Issuers - URI:http://pkicdp.uniperapps.com/cert/Uniper_Group_CA_3_2020.crt
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/Uniper_Group_CA_3_2020.crt
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.212.1
                  CPS: https://www.uniper.energy/pki
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pkicdp.uniperapps.com/crl/uniper_group_ca_3_2020.crl
                Full Name:
                  URI:http://crl.d-trust.net/crl/uniper_group_ca_3_2020.crl
            X509v3 Subject Key Identifier:
                D0:A8:8D:E1:FD:98:9C:CB:82:CA:20:D9:ED:5D:FF:71:DD:DB:2D:FF
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 19D99B7FDD7EC707AC3023D72F50D4AB5199AF1FDD3013A96815CBC99B63BFD6
    SPKI SHA256: 0E978103BC3B7160E6EF2C1EE50A6CA28E472B23588CF08C837D5625E363A696
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4788.2.212.1
- AIA OCSP: http://uniper-group-ca-3-2020.ocsp.d-trust.net
- AIA CA Issuers: http://pkicdp.uniperapps.com/cert/Uniper_Group_CA_3_2020.crt, http://www.d-trust.net/cgi-bin/Uniper_Group_CA_3_2020.crt
- CRL Distribution Points: http://pkicdp.uniperapps.com/crl/uniper_group_ca_3_2020.crl, http://crl.d-trust.net/crl/uniper_group_ca_3_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Uniper CA 3 2020 XXXII

- Subject: countryName=DE, organizationName=Uniper Holding GmbH, organizationalUnitName=CA, commonName=Uniper CA 3 2020 XXXII
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=Uniper Group CA 3 2020
- Serial: 7A49330A8FEA56164ACE5E0CAF949F82
- SHA-256: B576C4A703CB973079F8374EF359E4FD8788584B4E9FB4BC90A7E9F8C3838791
- SPKI SHA-256: 6F7032280D3A2FE15D8A9693E18A66D36FA34A6179E751EAB43AED545ABDCAD7
- Validity: 2020-04-21 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.d-trust.net/crl/uniper_ca_3_2020_xxxii.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4788.2.212.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://uniper-group-ca-3-2020.ocsp.d-trust.net
- CRL DP: http://pkicdp.uniperapps.com/crl/uniper_group_ca_3_2020.crl, http://crl.d-trust.net/crl/uniper_group_ca_3_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:49:33:0a:8f:ea:56:16:4a:ce:5e:0c:af:94:9f:82
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = Uniper Group CA 3 2020
        Validity
            Not Before: Apr 21 10:54:01 2020 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = Uniper Holding GmbH, OU = CA, CN = Uniper CA 3 2020 XXXII
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Authority Key Identifier:
                8C:C6:1E:65:2B:FD:63:DB:80:F8:D4:DD:3D:DA:F0:51:D0:9D:5F:22
            Authority Information Access:
                OCSP - URI:http://uniper-group-ca-3-2020.ocsp.d-trust.net
                CA Issuers - URI:http://pkicdp.uniperapps.com/cert/Uniper_Group_CA_3_2020.crt
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/Uniper_Group_CA_3_2020.crt
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.212.1
                  CPS: https://www.uniper.energy/pki
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pkicdp.uniperapps.com/crl/uniper_group_ca_3_2020.crl
                Full Name:
                  URI:http://crl.d-trust.net/crl/uniper_group_ca_3_2020.crl
            X509v3 Subject Key Identifier:
                56:ED:D2:DF:5D:40:6B:15:1D:6C:57:20:0D:78:91:4F:20:9C:9D:57
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B576C4A703CB973079F8374EF359E4FD8788584B4E9FB4BC90A7E9F8C3838791
    SPKI SHA256: 6F7032280D3A2FE15D8A9693E18A66D36FA34A6179E751EAB43AED545ABDCAD7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4788.2.212.1
- AIA OCSP: http://uniper-group-ca-3-2020.ocsp.d-trust.net
- AIA CA Issuers: http://pkicdp.uniperapps.com/cert/Uniper_Group_CA_3_2020.crt, http://www.d-trust.net/cgi-bin/Uniper_Group_CA_3_2020.crt
- CRL Distribution Points: http://pkicdp.uniperapps.com/crl/uniper_group_ca_3_2020.crl, http://crl.d-trust.net/crl/uniper_group_ca_3_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Uniper CA 3 2020 XXXIII

- Subject: countryName=DE, organizationName=Uniper Holding GmbH, organizationalUnitName=CA, commonName=Uniper CA 3 2020 XXXIII
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=Uniper Group CA 3 2020
- Serial: 770C4C750F9C34CD8F57565555FB7D80
- SHA-256: 364ED83755EA3EA8533856EFF72DE38271B54FF44905785EBF735BFFC29B6636
- SPKI SHA-256: 342A6BAFF45303D7E7ABE917242258FB228AD63CE80DB2EB26272CDA6F4E3195
- Validity: 2020-04-21 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.d-trust.net/crl/uniper_ca_3_2020_xxxiii.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4788.2.212.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://uniper-group-ca-3-2020.ocsp.d-trust.net
- CRL DP: http://pkicdp.uniperapps.com/crl/uniper_group_ca_3_2020.crl, http://crl.d-trust.net/crl/uniper_group_ca_3_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:0c:4c:75:0f:9c:34:cd:8f:57:56:55:55:fb:7d:80
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = Uniper Group CA 3 2020
        Validity
            Not Before: Apr 21 11:03:26 2020 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = Uniper Holding GmbH, OU = CA, CN = Uniper CA 3 2020 XXXIII
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Authority Key Identifier:
                8C:C6:1E:65:2B:FD:63:DB:80:F8:D4:DD:3D:DA:F0:51:D0:9D:5F:22
            Authority Information Access:
                OCSP - URI:http://uniper-group-ca-3-2020.ocsp.d-trust.net
                CA Issuers - URI:http://pkicdp.uniperapps.com/cert/Uniper_Group_CA_3_2020.crt
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/Uniper_Group_CA_3_2020.crt
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.212.1
                  CPS: https://www.uniper.energy/pki
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pkicdp.uniperapps.com/crl/uniper_group_ca_3_2020.crl
                Full Name:
                  URI:http://crl.d-trust.net/crl/uniper_group_ca_3_2020.crl
            X509v3 Subject Key Identifier:
                3E:D3:C7:96:34:92:1C:D0:A8:02:BC:B8:78:A8:44:D4:5F:06:56:AB
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 364ED83755EA3EA8533856EFF72DE38271B54FF44905785EBF735BFFC29B6636
    SPKI SHA256: 342A6BAFF45303D7E7ABE917242258FB228AD63CE80DB2EB26272CDA6F4E3195
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4788.2.212.1
- AIA OCSP: http://uniper-group-ca-3-2020.ocsp.d-trust.net
- AIA CA Issuers: http://pkicdp.uniperapps.com/cert/Uniper_Group_CA_3_2020.crt, http://www.d-trust.net/cgi-bin/Uniper_Group_CA_3_2020.crt
- CRL Distribution Points: http://pkicdp.uniperapps.com/crl/uniper_group_ca_3_2020.crl, http://crl.d-trust.net/crl/uniper_group_ca_3_2020.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Uniper Group CA 2 2015

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=Uniper Group CA 2 2015
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root CA 3 2013
- Serial: 0FE44C
- SHA-256: B4B2810E787B8E6DBB8B0EA9242D8E195AD5BF4201FD98A09AEDAC8B5F23FAFE
- SPKI SHA-256: AD9DFF7E2A5E116193FA9333DCC7710A9CD06D64AA046FBB32E8AE796BEF5AED
- Validity: 2015-11-12 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.d-trust.net/internet/files/D-TRUST_CP.pdf, http://www.d-trust.net/internet/files/UNIPER_PKI_CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.d-trust.net/crl/uniper_group_ca_2_2015.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.212.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://root-ca-3-2013.ocsp.d-trust.net
- CRL DP: http://pki.intranet.uniper.energy/crls/D-TRUST_Root_CA_3_2013.crl, http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl, ldap://cdp-ldap.intranet.uniper.energy/cn=D-TRUST%20Root%20CA%203%202013
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1041484 (0xfe44c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root CA 3 2013
        Validity
            Not Before: Nov 12 16:52:59 2015 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = Uniper Group CA 2 2015
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                3F:90:C8:7D:C7:15:6F:F3:24:8F:A9:C3:2F:4B:A2:0F:21:B2:2F:E7
            Authority Information Access:
                OCSP - URI:http://root-ca-3-2013.ocsp.d-trust.net
                CA Issuers - URI:http://pki.intranet.uniper.energy/cacerts/D-TRUST_Root_CA_3_2013.crt
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_Root_CA_3_2013.crt
                CA Issuers - URI:ldap://cdp-ldap.intranet.uniper.energy/cn=D-TRUST%20Root%20CA%203%202013,ou=ca,o=uniper,c=de?cACertificate?base?
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.212.1
                  CPS: http://www.uniper.energy/pki
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.intranet.uniper.energy/crls/D-TRUST_Root_CA_3_2013.crl
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
                Full Name:
                  URI:ldap://cdp-ldap.intranet.uniper.energy/cn=D-TRUST%20Root%20CA%203%202013,ou=ca,o=uniper,c=de?certificateRevocationList?base?
            X509v3 Subject Key Identifier:
                19:8D:DF:60:36:D0:0C:F9:BE:47:DB:C0:BB:A9:80:EC:8A:07:0F:90
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B4B2810E787B8E6DBB8B0EA9242D8E195AD5BF4201FD98A09AEDAC8B5F23FAFE
    SPKI SHA256: AD9DFF7E2A5E116193FA9333DCC7710A9CD06D64AA046FBB32E8AE796BEF5AED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.4788.2.212.1
- AIA OCSP: http://root-ca-3-2013.ocsp.d-trust.net
- AIA CA Issuers: http://pki.intranet.uniper.energy/cacerts/D-TRUST_Root_CA_3_2013.crt, http://www.d-trust.net/cgi-bin/D-TRUST_Root_CA_3_2013.crt, ldap://cdp-ldap.intranet.uniper.energy/cn=D-TRUST%20Root%20CA%203%202013
- CRL Distribution Points: http://pki.intranet.uniper.energy/crls/D-TRUST_Root_CA_3_2013.crl, http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl, ldap://cdp-ldap.intranet.uniper.energy/cn=D-TRUST%20Root%20CA%203%202013
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Uniper Group CA 3 2020

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=Uniper Group CA 3 2020
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root CA 3 2013
- Serial: 7699D2C8D20FDF8573BBCD9B7F689FA1
- SHA-256: A502172DEAF811DD7FA9BC3329AEA72589F2FAEC9401CB7348819C75F2E705B9
- SPKI SHA-256: C1F14428FE8865BAF2BFBDF889CD986100E62CA0E0AB12064520FD295997FBFF
- Validity: 2020-04-21 to 2028-09-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.d-trust.net/internet/files/D-TRUST_CP.pdf, http://www.d-trust.net/internet/files/UNIPER_PKI_CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.d-trust.net/crl/uniper_group_ca_3_2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4788.2.212.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://root-ca-3-2013.ocsp.d-trust.net
- CRL DP: http://pkicdp.uniperapps.com/crl/d-trust_root_ca_3_2013.crl, http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:99:d2:c8:d2:0f:df:85:73:bb:cd:9b:7f:68:9f:a1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root CA 3 2013
        Validity
            Not Before: Apr 21 08:56:59 2020 GMT
            Not After : Sep 20 08:25:51 2028 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = Uniper Group CA 3 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Authority Key Identifier:
                3F:90:C8:7D:C7:15:6F:F3:24:8F:A9:C3:2F:4B:A2:0F:21:B2:2F:E7
            Authority Information Access:
                OCSP - URI:http://root-ca-3-2013.ocsp.d-trust.net
                CA Issuers - URI:http://pkicdp.uniperapps.com/cert/D-TRUST_Root_CA_3_2013.crt
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_Root_CA_3_2013.crt
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.212.1
                  CPS: https://www.uniper.energy/pki
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pkicdp.uniperapps.com/crl/d-trust_root_ca_3_2013.crl
                Full Name:
                  URI:http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
            X509v3 Subject Key Identifier:
                8C:C6:1E:65:2B:FD:63:DB:80:F8:D4:DD:3D:DA:F0:51:D0:9D:5F:22
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A502172DEAF811DD7FA9BC3329AEA72589F2FAEC9401CB7348819C75F2E705B9
    SPKI SHA256: C1F14428FE8865BAF2BFBDF889CD986100E62CA0E0AB12064520FD295997FBFF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.4788.2.212.1
- AIA OCSP: http://root-ca-3-2013.ocsp.d-trust.net
- AIA CA Issuers: http://pkicdp.uniperapps.com/cert/D-TRUST_Root_CA_3_2013.crt, http://www.d-trust.net/cgi-bin/D-TRUST_Root_CA_3_2013.crt
- CRL Distribution Points: http://pkicdp.uniperapps.com/crl/d-trust_root_ca_3_2013.crl, http://crl.d-trust.net/crl/d-trust_root_ca_3_2013.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VR IDENT EV SSL CA 2020

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=VR IDENT EV SSL CA 2020
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 3 CA 2 EV 2009
- Serial: 4A103DB3E1D92662652B3BDC6AE5C2F3
- SHA-256: 9E6C8035C0F1C8A945310E72D83E531947B571F9292E42A4248A370BF7B305BE
- SPKI SHA-256: 9F69D9F333CB48D2A87AB6FA5FDA34D553A7887F98C9A8674DC76DDA847DA2FC
- Validity: 2020-04-21 to 2029-11-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.d-trust.net/internet/files/D-TRUST_CP.pdf, https://www.d-trust.net/internet/files/D-TRUST_CSM_PKI_CPS.pdf; https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.d-trust.net/crl/vr_ident_ev_ssl_ca_2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4788.2.230.1, 0.4.0.2042.1.4, 1.3.6.1.4.1.4788.2.202.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://root-c3-ca2-ev-2009.ocsp.d-trust.net
- CRL DP: http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl, ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%20EV%202009
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4a:10:3d:b3:e1:d9:26:62:65:2b:3b:dc:6a:e5:c2:f3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 3 CA 2 EV 2009
        Validity
            Not Before: Apr 21 08:27:08 2020 GMT
            Not After : Nov  5 08:50:46 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = VR IDENT EV SSL CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Authority Key Identifier:
                D3:94:8A:4C:62:13:2A:19:2E:CC:AF:72:8A:7D:36:D7:9A:1C:DC:67
            Authority Information Access:
                OCSP - URI:http://root-c3-ca2-ev-2009.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_Root_Class_3_CA_2_EV_2009.crt
                CA Issuers - URI:ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%20EV%202009,O=D-Trust%20GmbH,C=DE?cACertificate?base?
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.230.1
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_CSM_PKI_CPS.pdf
                Policy: 0.4.0.2042.1.4
                Policy: 1.3.6.1.4.1.4788.2.202.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%20EV%202009,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
            X509v3 Subject Key Identifier:
                0C:70:1B:54:9A:D2:B3:9A:F8:71:B4:1A:9D:F4:72:0B:29:9A:53:FD
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9E6C8035C0F1C8A945310E72D83E531947B571F9292E42A4248A370BF7B305BE
    SPKI SHA256: 9F69D9F333CB48D2A87AB6FA5FDA34D553A7887F98C9A8674DC76DDA847DA2FC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4788.2.230.1, 0.4.0.2042.1.4, 1.3.6.1.4.1.4788.2.202.1
- AIA OCSP: http://root-c3-ca2-ev-2009.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_Root_Class_3_CA_2_EV_2009.crt, ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%20EV%202009
- CRL Distribution Points: http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl, ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%20EV%202009
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VR IDENT SSL CA 2020

- Subject: countryName=DE, organizationName=D-Trust GmbH, commonName=VR IDENT SSL CA 2020
- Issuer: countryName=DE, organizationName=D-Trust GmbH, commonName=D-TRUST Root Class 3 CA 2 2009
- Serial: 60343953CF3A8CA42BB44A44292CBAF4
- SHA-256: 007108194115F3C899F54EE67CB4DA87275EDC1D6798DA787E0758CFA6AE96B1
- SPKI SHA-256: B4E0E53797962896F38DA7A2F13486D02127BE4AF22CB66F377621D85B9C4D5B
- Validity: 2020-04-21 to 2029-11-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.d-trust.net/internet/files/D-TRUST_CP.pdf, https://www.d-trust.net/internet/files/D-TRUST_CSM_PKI_CPS.pdf; https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.d-trust.net/crl/vr_ident_ssl_ca_2020.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4788.2.230.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://root-c3-ca2-2009.ocsp.d-trust.net
- CRL DP: http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl, ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%202009
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            60:34:39:53:cf:3a:8c:a4:2b:b4:4a:44:29:2c:ba:f4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = DE, O = D-Trust GmbH, CN = D-TRUST Root Class 3 CA 2 2009
        Validity
            Not Before: Apr 21 08:37:48 2020 GMT
            Not After : Nov  5 08:35:58 2029 GMT
        Subject: C = DE, O = D-Trust GmbH, CN = VR IDENT SSL CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Authority Key Identifier:
                FD:DA:14:C4:9F:30:DE:21:BD:1E:42:39:FC:AB:63:23:49:E0:F1:84
            Authority Information Access:
                OCSP - URI:http://root-c3-ca2-2009.ocsp.d-trust.net
                CA Issuers - URI:http://www.d-trust.net/cgi-bin/D-TRUST_Root_Class_3_CA_2_2009.crt
                CA Issuers - URI:ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%202009,O=D-Trust%20GmbH,C=DE?cACertificate?base?
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4788.2.230.2
                  CPS: http://www.d-trust.net/internet/files/D-TRUST_CSM_PKI_CPS.pdf
                Policy: 0.4.0.2042.1.7
                Policy: 1.3.6.1.4.1.4788.2.202.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl
                Full Name:
                  URI:ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%202009,O=D-Trust%20GmbH,C=DE?certificaterevocationlist
            X509v3 Subject Key Identifier:
                C9:1C:64:68:AC:6C:18:CA:21:D5:4D:54:7B:53:56:A2:90:93:AA:91
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 007108194115F3C899F54EE67CB4DA87275EDC1D6798DA787E0758CFA6AE96B1
    SPKI SHA256: B4E0E53797962896F38DA7A2F13486D02127BE4AF22CB66F377621D85B9C4D5B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.4788.2.230.2, 0.4.0.2042.1.7, 1.3.6.1.4.1.4788.2.202.2
- AIA OCSP: http://root-c3-ca2-2009.ocsp.d-trust.net
- AIA CA Issuers: http://www.d-trust.net/cgi-bin/D-TRUST_Root_Class_3_CA_2_2009.crt, ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%202009
- CRL Distribution Points: http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl, ldap://directory.d-trust.net/CN=D-TRUST%20Root%20Class%203%20CA%202%202009
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
